WellRight Privacy Policy

Last Updated: August 13, 2026 | Version 3.1

This WellRight Privacy Policy (this “Privacy Policy”) applies to the websites, applications, and electronic communications on which it appears (the “Platform”). The policy describes how WellRight, Inc. as well as our affiliates (collectively, “WellRight”, “the Company”, “we”, or “us”) collect, use, disclose, store and otherwise process Personal Information about you. Please read this Privacy Policy carefully, by interacting with us through the Platform you consent to this Policy.

I. APPLICATION OF THIS PRIVACY POLICY TO THE WELLRIGHT PROGRAM AND WEBSITES

WellRight Program

Services provided by the Company, include an interactive health risk assessment and health and wellbeing management program that generates reports and recommended plans of action, as well as educational materials, based on information entered into the system, which may be accessed through a web-based portal or an application (the “Program”). This information may be entered by you or by someone using the Program on your behalf (such as a friend, family member, or other person). These reports can be used by you to learn more about your general overall wellbeing and health, and to track and monitor your particular wellbeing activities and goals. The more you engage with the Program, the more you will learn about your particular health situation.

We provide the Program to you on behalf of an employee benefits administrator, pharmacy, retailer or other entity that provided you access to the Program (“Program Sponsor”), in some cases through an embedded or co-branded website. In some, but not all, instances we are the relevant Program Sponsor’s “Business Associate” as defined by the Health Insurance Portability and Accountability Act of 1996, and the implementation regulations thereunder (“HIPAA”), and in such cases, we will comply with HIPAA and the applicable contractual limitations imposed on our use and disclosure of your Personal Information by the Program Sponsor. Even in instances where HIPAA does not apply, in most instances we are contractually bound to process Personal Information under the relevant Program Sponsor’s instructions, and we strongly advise you to review privacy notices provided by any Program Sponsor. While all Personal Information we collect or receive is subject to this Privacy Policy, in instances where contractual limitations we have agreed to with a Program Sponsor do not permit a use or disclosure of Personal Information that is described in this Privacy Policy, we comply with such contractual limitations.

WellRight Websites

In addition to information collected through the Program, we also collect information about individuals who visit WellRight-operated websites that link to this Privacy Policy (collectively, the “Site”).

For clarity, this Privacy Policy uses two specific terms where it describes cookies and similar technologies. "Site" means WellRight’s public marketing websites, including www.wellright.com, which are open to anyone and do not require an account. "Program" means the WellRight wellness program you access with an account, including the health assessment, through a web browser or a mobile application. Where this Privacy Policy describes cookies and similar technologies, it refers to the Site or the Program specifically. Statements about one do not apply to the other. In this Privacy Policy, "cookies and similar technologies" means cookies and any comparable method of storing or reading information on your device or browser, including browser local storage, session storage, pixels, tags, and software development kits used in our mobile applications.

II. WHAT TYPES OF PERSONAL INFORMATION DO WE COLLECT?

We collect several categories of Personal Information from and about users of the Platform. “Personal Information” means information that would allow someone to identify, relates to, describes, or is reasonably capable of being associated with or linked to an individual. Personal Information does not include aggregated information that, by itself, does not permit the identification of individual persons, such as statistics about how many visitors the Site last month.

The categories of Personal Information we collect related to an individual depend on whether the Program is used by the individual and/or if the Site is visited. The categories of Personal Information we collect may include:

Contact and Demographic Information - If you submit an inquiry, register for an account, or provide information on or through our Site or the Program, we may collect your contact and demographic information including your name, mailing address, email address, phone number, unique identification number (provided to WellRight by the Program Sponsor allowing you to establish your Program account) (“UID”), and date of birth.

Commercial Information - If you submit an inquiry, or provide information on our Site, we may collect commercial information including information about your interest in subscribing to the Program.

Usage Information - When you use our Site or the Program, we may automatically record information, including your Internet Protocol address (IP Address), geolocation of your device, unique device identifier, operating system, network settings, browser type, referring URLs (e.g., the website you visited before coming to our Site), domain names associated with your internet service provider, and any other information regarding your interaction with our Site or the Program.

Information you Communicate with Us - We may collect Personal Information contained within your communications with us via email, chat functionality, social media, telephone, or otherwise, and in certain cases we may use third-party service providers to do so.

Where permitted by applicable law, we may collect and maintain records of calls and chats with our agents, representatives, or employees via message, chat, post, or similar functionality.

Health Information – In your use of the Program, you may provide us with, or authorize us to receive from connected devices and services, “Health Information,” which includes information related to your health and wellness, such as biometric screening information (including height, weight, blood pressure, and blood glucose levels), activity and exercise data, biometric and physiological measurements, sleep information and related summaries, health habits, nutrition, and related device settings or measurement preferences. Health Information does not include sensitive information regarding your health history, such as prescriptions, procedures, clinical notes, full problem lists, or provider identity; nor does it include contact and account information entered when registering for the Program. Health Information is considered Personal Information only when it can be linked or associated with the individual to whom it relates.

III. HOW DO WE COLLECT PERSONAL INFORMATION?

A. Directly From You. We collect a range of Personal Information from you in order to provide the Program to you. If you do not provide the Personal Information we request, we may not be able to provide you with full use and benefit of our Program. To use the

Program you will be required to provide certain Personal Information to establish an account to use the Program, including the UID and an email address. In using the Program, we will also collect Health Information from you directly (such as through your completion of an Assessment on the Program).

B. From Third Parties. We may collect Personal Information from third parties, including but not limited to our business partners, including the Program Sponsors and their service providers, and third parties who you direct to send information about you to our Program. This includes health and fitness data from connected devices you choose to link, such as data we receive through the Google Health API when you connect a Fitbit or Google device, as described in the Data From Connected Devices section below.

C. Information Collected Automatically. We collect Personal Information automatically using cookies and similar technologies when you use the Program and the Site, as described below:

Browsing Information. When you browse or use the Site or the Program, we may collect certain browsing information, including: (a) IP address, (b) the date and time at which you accessed the Site or the Program, (c) the pages that you visited, (d) the link you followed to reach the Program or Site, and (e) your browser and operating system.

Cookies and Device Identifiers. Cookies are small files that are placed on your computer’s hard drive by your Internet browser. A device identifier is a unique identifier assigned to the device that you use to access the Site or the Program. We use cookies or device identifiers on our Site and the Program to identify visitors who have used the Platform before. How this differs between our public website and the wellness program. We use cookies and similar technologies differently in each place. On our public marketing Site we use analytics and advertising technologies common to business websites. Inside the Program, we do not. There, we use only technologies necessary for the Program to operate, to keep you signed in securely, to monitor performance and reliability, and to understand how features are used so we can improve them.

Your employer or program sponsor may operate its own websites and communications that link to the Program. Those are governed by your sponsor’s own privacy notices, not this one. Sponsors and their service providers cannot place cookies or similar technologies inside the Program itself. Most browsers provide you with the ability to block, delete, or disable cookies, and your device may allow you to disable transmission of device identifiers. If you choose to reject cookies or block device identifiers, some features of the Site and the Program may not be available or some functionality may be limited or unavailable. WellRight does not track users over time and across third party websites to provide targeted advertising. The Program does not use advertising, targeting, retargeting, or cross-context behavioral advertising technologies. We do not use cookies or similar technologies within the Program to build advertising profiles, we do not sell or share Program data for advertising purposes, and we do not permit third parties to conduct advertising or cross-site tracking within the Program. Accordingly, we do not currently respond or take any action with respect to web browser "do not track" signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of Personal Information about an individual consumer's online activities over time and across third-party web sites or online services. We process opt-out preference signals, including Global Privacy Control, on our Site. When we detect a signal from your browser or device, we treat it as a valid request to opt out of the sale and sharing of your personal information for that browser or device and for any profile we associate with it. We will indicate on the Site when we have recognized your signal. No personal information collected through the Program is sold or shared, so no opt-out preference signal applies there. For more information about cookies visit: http://www.allaboutcookies.org/. Web beacons, pixels, and other tracking technologies operate independent of cookies.

Android Advertising ID. The Android Application uses a 3rd party (Google Firebase Analytics) which makes use of the Android Advertising ID to collect analytics information. The Android Advertising ID is not used in any other context within the application. Technologies by surface. On our public Site, we use analytics services to understand how visitors find and use the website, advertising and conversion measurement services to evaluate our marketing, marketing automation services to manage enquiries and communications, and business-audience analytics services that help us understand which organizations are interested in our services. Inside the Program, we use only a small number of technologies: those necessary to operate the Program and keep your session secure, an application performance monitoring service that records technical errors and performance measurements, and a product analytics service that records which features are used and delivers in-product guidance. The product analytics service receives a randomly generated identifier rather than your name or email address. No advertising or cross-site tracking technology operates in the Program. These cookies may be ones placed by us (first-party) or by a third party. We may use cookies that are session-based or persistent. Session cookies expire when you close your browser or turn off your device. Persistent cookies remain on your device after you close your browser or turn off device.

We may use a variety of cookies:

 

You can control cookies and tracking tools. Some browsers have a “do not track” feature that prevents a website from tracking you, as well as additional cookie settings. Our Platform does not currently respond to these signals. If you choose to block cookies and other trackers, certain features of the Platform may not work. Blocking or rejecting cookies will not stop all of the tracking described in this Policy.

Browser and device settings vary and are not uniform. You can generally find these controls in the settings, options, or preferences menu of your browser. The following resources for commonly used browsers may be helpful, or you can use your browser’s help feature for additional information:

• Cookie settings in Microsoft Edge
• Cookie settings in Mozilla Firefox
• Cookie settings in Google Chrome
• Cookie settings in Safari on Mac
• Cookie settings in Safari on iPhone and iPad

To learn more about managing and deleting cookies, visit AboutCookies.org.

For more information about your choices concerning the use of your browsing activity for interest-based advertising, you may visit:

• Network Advertising Initiative privacy-choice resources
• Digital Advertising Alliance WebChoices
• Digital Advertising Alliance AppChoices
• European Interactive Digital Advertising Alliance—Your Online Choices

These industry tools generally apply only to participating companies, and you may need to exercise your choices separately for each browser or device you use.

On a mobile device, you may also be able to adjust your device settings to limit advertising-related tracking. For more information, see:

• Apple’s app-tracking controls for iPhone and iPad
• Android advertising privacy settings

IV. HOW DO WE USE PERSONAL INFORMATION?

To the extent permitted by applicable law, we use Personal Information:

• To provide and personalize the Program and our Site, such as maintaining and servicing your account on the Program, verifying your information and eligibility, and creating reports and interactive educational and health tracking features made available through the Program. Reports may include interactive features, and wellness trackers and tools. Based on the information that is entered into the Program, we may provide you with links to personal challenges, courses, or other features of the Program that are likely of interest to you.

WellRight provides social and community features. These sections are voluntary to join. No Health Information is directly provided to the community by WellRight. Some of the community sections, such as a “Diabetic Forum” may allow other participants to draw inferences about a particular user’s health, even though no specific details regarding the user’s health is provided by WellRight to the community. As a user, you must decide what information you wish to provide to the community forums.

• To communicate with you. We may use Personal Information to contact you if you request or have consented for us to do so, if there is a problem or an update to your account that requires you to be notified, or, if you are a registered user of the Program, to send you information relating to the Program or similar services that we provide. You may withdraw your consent or opt out to receiving certain communications (e.g., marketing communications) by following the instructions provided in the messages that you receive.

• To optimize, improve and maintain the Program and the Site, including understanding how users interact with the Program and the Site, gauging user interest in certain Program or Site functionality, and troubleshooting problems. We may also anonymize some Personal Information so that it is no longer associated with you. In this case, we are entitled to retain and use information freely.

• For legal, security, or safety reasons, such as protecting our and our users' safety, property, or rights; complying with legal requirements; enforcing our terms, conditions, and policies; detecting, preventing, and responding to security incidents; and protecting against malicious, deceptive, fraudulent, or illegal activity.

• As part of a corporate transaction, such as in connection with the sale of part or all of our assets or business, the acquisition of part or all of another business or another business' assets, or another corporate transaction, including bankruptcy.

• To fulfill any other purpose for which you provide it, including purposes described when you provide the information or give your consent.

V. UNDER WHAT CONDITIONS DO WE DISCLOSE YOUR INFORMATION?

We do not disclose—including selling, leasing, renting, loaning, or transferring—Personal Information to third parties except as stated in this Privacy Policy, as may be permitted by our agreements with the Program Sponsor, when relevant, and/or with your explicit consent. Our disclosure of Personal Information is limited to the types of recipients and the purposes described in this section:

Contractors. We use contractors to help support certain aspects of our business operations, and in some instances, in order to provide services for us, such service providers require access to Personal Information. We takes steps to contractually require that these contractors maintain and protect the confidentiality and security of Personal Information and use Personal Information only as necessary to perform the Program they are asked to perform. Such service providers may include technology companies and online service providers. We never use, disclose, or share your Personal Information collected through the Program for third-party marketing purposes, and we never sell, rent or lease your Personal Information to third parties. At the request of your Program Sponsor, we may use and aggregate your Personal Information to deliver you targeted messages related to the Program. Combining data sets for a Program Sponsor in this way may be deemed to constitute a sale of Personal Information under certain laws.

Program Sponsors. We may share Personal Information with the relevant Program Sponsors. Such Personal Information will only be shared on an identifiable basis if permitted by applicable law, and generally, Personal Information is aggregated prior to sharing with the Program Sponsor.

Other Disclosures. We may share Personal Information with third parties under the following circumstances: (i) in connection with a court order, subpoena, government investigation, or when otherwise required by law; (ii) in the event of a corporate sale, merger, acquisition, or similar event; (iii) to work with third-party companies to support any technical operation or execute a specific promotion or program (such as providing responses to conduct surveys, or maintain a database of visitor information, etc.); (iv) to enforce or investigate a potential violate of any agreement you have with us; (v) to detect, prevent, or otherwise respond to fraud, security or technical concerns, (vi) to support our audit and compliance functions and to protect the rights and safety of our Company and its employees, customers, and the public against harm, and (vii) when explicitly requested by or consented to by you for the purposes indicated in such request or consent.

VI. YOUR RIGHTS RELATING TO PERSONAL INFORMATION?

Depending on where you live, you may have the following rights with respect to your Personal Information under applicable data protection laws:

• Access. You may have the right to request access to and obtain a copy of any Personal Information we may have about you.

• Deletion. You may have the right to delete your Personal Information that we have collected or obtained, subject to certain exceptions.

• Correction. You may have the right to request corrections to inaccuracies in your Personal Information, subject to certain exceptions.

• Opt out of certain processing. Where we engage in targeted advertising, or the sale or sharing of your Personal Information, you may opt out. These activities occur only in connection with our public Site. You can exercise this choice using the cookie preference control on the Site, or by using a recognized opt-out preference signal. No Personal Information collected through the Program is used for targeted advertising, sold, or shared. We do not offer the option to limit its use. We also do not profile you or other individuals in a manner that would result in legal or similarly significant effects, so we do not offer an opt out related to processing Personal Information for this purpose.

• Data portability. You may have the right to receive a copy of your information in a portable and readily usable format.

• Objection/Restriction of Processing. You may have the right to object or restrict us from processing your Personal Information in certain circumstances.

• Withdraw Consent. You may have the right to withdraw your consent where we are relying on your consent to process your Personal Information. Related to participation in the Program, if you withdraw your consent, you may be ineligible for rewards offered through the Program by the relevant Program Sponsor that are based on health-related objectives and metrics.

• Automated Decision-Making. You have the right to know when you are subject to automated decision-making, the Personal Information used to render the decision, the principal factors and parameters involved in the decision, and human review or correction of the decision (or its underlying data, where appropriate). You may also have the right to consent or opt out of this automated decision-making, depending on your location.

• Lodge a Complaint - The right to lodge a complaint with a supervisory authority or other regulatory agency if you believe we have violated any of the rights afforded to you under applicable data protection laws. We encourage you to first reach out to us so we have an opportunity to address your concerns directly before you do so.

If you otherwise believe that we have collected Personal Information about you, and would like to exercise your rights listed above, please email us at privacy@wellright.com or submit a ticket through our customer portal.

Depending on the type of information (i.e., Personal Information or Health Information) and our relationship with the relevant Program Sponsor, we will either (i) make the change; (ii) direct you to contact the applicable Program Sponsor; or (iii) promptly forward your request to the applicable Program Sponsor.

You have a right not to receive discriminatory treatment by any business when you exercise your privacy rights. This means we will not deny goods or services to you, provide different prices or rates for goods or services to you, or provide a different level or quality of goods or services to you. You will not be discriminated against in any way by virtue of your exercise of the rights listed in this Policy. However, should you withdraw your consent or object to processing of your Personal Information, or if you choose not to provide certain Personal Information, we may be unable to provide some, or all, of the Program services to you.

Verification. Only you, or an authorized agent that you authorize to act on your behalf, may make a request related to your Personal Information. We must verify your identity before fulfilling your requests. If we cannot initially verify your identity, we may request additional information to complete the verification process. We will only use Personal Information provided in a request to verify the requestor’s identity. If you are an authorized agent making a request on behalf of a California consumer, we will also need to verify your identity, which may require proof of your written authorization or evidence of a power of attorney.

We endeavor to respond to requests within the time period required by applicable law. If we require more time, we will inform you of the reason and extension period in writing.

We do not charge a fee to process or respond to your requests unless they are excessive or repetitive. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

We may deny certain requests, or only fulfill some in part, as permitted or required by law. If you are not satisfied with the resolution of your request, and pursuant to applicable state law, you are afforded a right to appeal such decision, you may seek to appeal the decision by contacting us through any of the methods set forth at the beginning of this Section XI. In submitting the request, please indicate that the submission is a “Notice of Appeal,” and fully describe your concerns and disagreement.

You don’t need to create an account with us as part of a Program in order to make a request to exercise your rights hereunder.

VII. CHILDREN'S PRIVACY

The Program is not intended for use by children. Accordingly, we do not intend to collect Personal Information from anyone we know to be under 18 years of age. The Platform is not designed for use by persons under the age of 16, and we do not knowingly collect Personal Information about children under the age of 16. If you are a parent or legal guardian and think your child has given us information you can email us at privacy@wellright.com. You can also write to us at the address listed in the “Contact Us” section of this Policy. Please mark your inquiries “COPPA Inquiry.”

VIII. HOW DOES THIS PRIVACY POLICY RELATE TO THIRD-PARTY WEB SITES?

We cannot control, nor are we responsible for, the privacy practices or content of third-party websites and applications linked to or from the Platform, including information or content contained within them. Our Privacy Policy applies solely to Personal Information collected through the Platform.

IX. HOW DOES THE COMPANY PROTECT PERSONAL INFORMATION AND HEALTH INFORMATION?

Security Measures. We have implemented commercially reasonable and industry standard measures designed to secure your Personal Information from accidental loss and from unauthorized access, use, alteration, and disclosure. Except as provided elsewhere in this Privacy Policy, we limit access to Personal Information to those persons in our organization who have a business need (including servicing your account, informing you of news and offers, or aggregating information) for such access. No company, including us, can fully eliminate security risks associated with Personal Information. As such, we cannot guarantee that our standard measures will prevent a third party from circumventing our security measures and unlawfully intercepting or accessing transmissions or private communications.

Data from Connected Devices.

When you choose to connect a Fitbit or Google device to the Program, you authorize Google to share health and fitness data with us through the Google Health API. The specific data we receive depends on the permissions you grant and may include:

Activity and fitness data, such as steps, distance, floors climbed, active minutes, active zone minutes, activity level, altitude, calories burned (total and within heart-rate zones), exercise and workout sessions, sedentary periods, and VO2 Max.

Health metrics and measurements, such as weight, body fat, heart rate, heart rate variability, resting heart rate, heart-rate zones, oxygen saturation (SpO2), respiratory rate, and sleep-related temperature and respiratory summaries, including daily summaries of these metrics.

Sleep data, such as sleep sessions and sleep stages (awake, light, deep, and REM) and related sleep summaries.

Device settings, such as your unit and measurement preferences. We use this data only to provide and personalize the Program features you use. We store and protect it as described in Section IX, and we retain and delete it as described in Sections VI and XII. You may disconnect your device at any time to stop sharing new data with us; disconnecting does not delete data we have already received, and you may request deletion of your account and its associated data at any time. We may share this data with service providers that support this integration, under contractual confidentiality and security obligations and only as needed to provide the feature. We do not use this data for advertising, we do not sell it or share it with data brokers or information resellers, and we do not use it to determine creditworthiness or for lending. Our use and transfer of information received from Google APIs, including data derived from it, adheres to the Google API Services User Data Policy, including its Limited Use requirements.

X. FOR CALIFORNIA RESIDENTS

California Civil Code Section 1798.83 permits users that are residents of California to request certain information regarding a company’s disclosure of personal information (as defined by California law) to third parties for such third parties’ direct marketing purposes. If you are a California resident and would like to make such a request, please contact us as set forth above in Section VI.

In addition, the state of California provides California residents with certain other rights concerning their Personal Information. This section describes (1) the categories of Personal Information, collected and disclosed by us, subject to California privacy law, (2) your privacy rights under California privacy law, and (3) how to exercise your rights.

Sources of Personal Information. We collect Personal Information from the categories of sources detailed in Section III above: (i) directly from you; (ii) from third parties; and (ii) data collected automatically through tracking technologies.

Use of Personal Information. We collect Personal Information for the business and commercial purposes detailed in Section IV above.

Disclosure of Personal Information. The categories of third parties to which we disclose personal information for a business or commercial purpose or to whom we sell or share personal information are summarized in the chart below. We do not knowingly collect, sell, or share the personal information of minors under the age of 16. *While we do not disclose your Personal Information to third parties in exchange for monetary compensation, in certain instances we do share your Personal Information with third parties for cross-contextual behavioral advertising (i.e., targeted advertising based on your Personal Information and activity on our Site and across websites, which could be deemed a “sale” of Personal Information under applicable laws. Personal Information collected through the Program is not utilized for this purpose.

We do not collect the following types of Personal Information (as specified pursuant to California law): Biometric identifier information (e.g., DNA, fingerprints, retinal scans voice recordings, etc.); audio, electronic, visual, thermal, olfactory, or similar information; and education information, defined as information that is not publicly available personally identifiable information as defined in the Family Education Rights and Privacy Act.

We will retain each category of your Personal Information for as long as necessary to fulfill the purposes described in Section IV, unless otherwise required by applicable laws. Criteria we use to determine how long we retain your Personal Information includes whether: we need your Personal Information to provide you with products or services you have requested; we continue to have a relationship with you; you have requested information, products, or services from us; we have a legal right or obligation to continue to retain your information; we have an obligation to a third party that involves your information; our retention or recordkeeping policies and obligations dictate that we retain your information; we have an interest in providing you with information about our products or services; and we have another business purpose for retaining your information.

Your Privacy Rights Under California Law. If you are a resident of the State of California, you have the following rights:

Depending on the type of information (i.e., Personal Information or Health Information) and our relationship with your Program Sponsor, we will either (i) make the change in accordance with Section XI; (ii) direct you to contact the applicable Program Sponsor; or (iii) promptly forward your request to the applicable Program Sponsor. Only you, or an authorized agent that you authorize to act on your behalf, may make a request related to your Personal Information. You may also make a request on behalf of your minor child.

XI. International Use and Cross Border Transfers

If you are visiting the Platform from outside of the United States, please note that the Platform is hosted in the United States. Where permitted by applicable law, we may transfer the Personal Information we collect about you to the United States for the purposes set out in this Notice. For individuals in the European Union, European Economic Area, Switzerland, and United Kingdom: we will only transfer Personal Information to third parties located outside of this region when it has ensured appropriate safeguards for such Personal Information through use of the standard contractual clauses or other lawful and approved methods. To request a copy of applicable cross-border data transfer agreements, please reach out using the information in the Contact Us section.

XII. Retention of Personal Information

We retain Personal Information for the period necessary to fulfill the purposes for which it was collected as described in this Privacy Policy, and no longer than is reasonably necessary for those purposes.

Information collected through the Program. Following expiration of an agreement with a Program Sponsor, Personal Information relating to that agreement remains available for Sponsor download for 90 days, after which it is automatically deleted from our production systems unless a longer retention period is required by law. Backup copies containing that information expire and are deleted within 35 days of that deletion.

Information you provide through our Sites. Information submitted through our websites, such as contact and inquiry information, is retained for the period necessary to respond to your inquiry and to maintain our business relationship. That period is determined by the nature of the inquiry, whether an ongoing relationship results, your consent choices where applicable, and any applicable legal or contractual obligation.

Information collected automatically. Technical, performance, and usage information collected automatically through the Program and our Sites is retained for the period necessary to operate, secure, and improve our services. That period is determined by the purpose for which the information was collected, the operational and security monitoring it supports, and any applicable legal or contractual obligation.

XIII. GENERAL

Amendments to this Privacy Policy. WellRight may modify or update this Privacy Policy from time to time, so please review it periodically. Where required by applicable law, we will provide you with notice of material changes to the Privacy Policy and, if further required by law, provide you with an opportunity to consent to such changes. Unless otherwise indicated, any changes to this Privacy Policy will apply immediately upon posting to the Platform.

Contact WellRight’s Privacy Officer. Our intention is to be diligent in protecting your privacy by strictly following our Privacy Policy. If you would like to make suggestions or find out more about our privacy practices, please contact our Privacy Officer at privacy@wellright.com or call (312) 724-6925. Our mailing address is WellRight, Inc., PO Box 773178 Chicago, IL 60677-3178. Miscellaneous. The term “including” in this Privacy Policy means “including without limitation.”