Privacy Policy

Last Updated: September 3, 2024

At Kleos Health, we value that our customers, business partners, employees, and patients trust us with their Personal Data. This Privacy Policy (“Privacy Notice”) tells you about our current privacy practices, including what Personal Data we collect and how we may use, share, or manage it. It also explains your rights and choices regarding the Personal Data you give us. Please review this Privacy Notice before using our Services or sharing any Personal Data with us.

1. Scope

This Privacy Notice applies when you use our websites, mobile apps, and other services, tools, and online applications or when you interact with us in other ways, such as through our customer service or at our in-person events (all of these are our “Services”).

Throughout this Privacy Notice, we use the following defined terms:

• “Kleos Health,” “we,” “us,” or “our” refers to the business that is responsible for the management of your Personal Data (often referred to as a data controller). This is usually the business that collects your Personal Data.

• “Personal Data” refers to any information that directly or indirectly — for example, through combining pieces of data so that you can be identified — identifies you specifically. Personal Data does not include information that is publicly available, de-identified or aggregated.

If you have any questions about this Privacy Notice, please email support@kleoshealthcare.com

When you use our Services and give us your Personal Data, you agree that we will process your Personal Data according to this Privacy Notice, including any terms specific to your location. If you do not agree with the practices described in this Privacy Notice, please do not give us your Personal Data or use our Services. Where required by applicable law, we will not collect, use, or disclose your Personal Data without first obtaining your consent.

If you are in the United States, please note this Privacy Notice does not apply to our use, collection, or disclosure of Protected Health Information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”).

2. Personal Data We Collect

Depending on how you use our Services, we may collect different kinds or amounts of Personal Data about you. This could include any or all of the types of Personal Data that follow.

• Identifiers and Non-Public Personal Information, such as your name, contact details, account number, registration information (including username and password), government-issued identification number, and payment details

• Internet Activity Information, such as how you interact with our Services, social media pages, or marketing and advertising, the websites that refer you to us, the pages you visit, links or buttons you click, your browser or device type, IP address, internet service provider, and user preferences

• Commercial Information, such as purchase and order history, as well as payment or other financial information

• Audio, Electronic, Visual, or Similar Information, such as call or video recordings, pictures taken at our events, email or text exchanges, direct messages you exchange with us, and chat logs from your communications with us

• Any other information you voluntarily provide to Kleos Health

3. How Your Personal Data is Collected

When you use our Services, we may collect Personal Data from you, your browser or device, and other sources, which are described in more detail below.

Personal Data Collected from You

We may ask you to provide Personal Data at different times and places on our Services. For example, we may collect Personal Data from you when you:

• Register or create an account

• Purchase products

• Subscribe to, or interact with, our email updates and newsletters

• Respond to a voluntary survey

• Contact our office

• Connect with, link to, or “share” our Services via social media

• Register for or attend one of our in-person events or an event that we are in attendance of

• Provide ratings, reviews, or feedback

• Apply to work with Kleos Health

Please be aware that we may not be able to manage your account or provide you with the products or services you request if you do not give us Personal Data that is marked as required. You also may not be able to use all features of our Services.

If you give us Personal Data of another person, make sure they have seen this Privacy Notice and that you have their permission before giving their Personal Data to us.

Personal Data Collected through Automated Means

Device or Browser: Certain information is automatically collected from your device or browser and analyzed when you interact with our Services, our marketing or advertising, our social media pages, and our email communications. Some of this information is collected by others on our behalf.

Cookies and Other Tracking Technologies: We use cookies, web beacons/pixel tags, and other tracking technologies (collectively, “cookies”) to recognize you when you visit our websites or mobile apps. Cookies are small bits of data cached or stored on your computer or mobile device. These cookies may be delivered in a first-party or third-party context. For example, we may collect information about your browser type and version, operating system, user language, viewed web pages, links that are clicked, IP address, screen resolution, and web pages visited before and after visiting our websites or mobile apps. Our emails to you also may contain tracking technologies to help us understand when you open an email or click links within it.

By collecting this information, we can better understand how you interact with us; give you a more personal and optimized online experience by recognizing your preferences; improve our Services; fulfill contracts with our business partners; help confirm receipt of and response to our emails; and provide more effective customer service.

Personal Data Collected from Other Sources

We may also receive your Personal Data from various other sources, such as our affiliates, advertising networks, business partners, contractors, data analytics providers, or social media networks.

4. How We Use and Share Your Personal Data

We use Personal Data for:

• Customer Service, including answering your questions or responding to your requests

• Communications, such as sending you reminders or updates, administrative messages, service bulletins, informational materials about Kleos Health or our business partners, educational materials, or other information you request

• Fulfillment, including creating your online account, processing purchase orders, or tracking and keeping you informed about your order status

• Customer Experience, including serving content and allowing you to use interactive features; developing our products and services; performing analytics and conducting customer research; validating your eligibility to access or use certain products or services, such as those only available to healthcare professionals

• Personalization, such as when you set your preferences on our Services or when we enhance our data to better understand you and your interests

• Direct Marketing, including sending you information about offers, promotions, or our products or services we think might interest you

• Promotions, including administering our online surveys or special offers or those of our business partners

• Security and Integrity, including fraud prevention, public safety, or enforcement of our policies and procedures

We may disclose any Personal Data we collect to the following recipients for the purposes outlined above:

• Our Affiliates and Business Partners. Our affiliates and business partners may use your Personal Data for the purposes described above. For example, we sometimes operate as a service provider to our business partners and will disclose Personal Data we collect on their behalf with them.

• Service Providers. We engage contractors, suppliers, and other vendors who provide services on our behalf and at our instruction, such as assisting with processing and fulfilling orders; delivery and logistics; data storage; fraud prevention; data and Services analytics, including the placement and use of cookies; our communications, advertising, and marketing, including the effectiveness of our advertising and marketing efforts; or other services in support of our business.

We may use and disclose any Personal Data as reasonably necessary to comply with the law or our legal requirements, cooperate with and respond to law enforcement requests, or as otherwise required by applicable law, court order, or government regulations. We also use Personal Data we collect as necessary to maintain appropriate records for internal administrative purposes, to protect our rights and interests or those of others, to resolve any disputes, to enforce our policies, or to prevent harm. Any Personal Data we collect may be provided to our professional advisors, including accountants, auditors, consultants, and lawyers, when reasonably necessary for our professional advisors to perform services for us and give us appropriate advice. Any and all Personal Data we collect may be given to another company in the event of a sale, merger, or other acquisition of some or all of our assets or business or as part of the negotiation or evaluation of such sale, merger, or other acquisition.

5. Your Privacy Rights and Choices

Direct Marketing: You may choose to opt out of receiving direct marketing, commercial emails, and other educational materials from us about our products and services by following the instructions contained in the communications we send. Please allow five (5) business days for your request to be processed. Please also note that even if you unsubscribe, we may still send you transactional or administrative communications, including, for example, to manage any account you have with us, respond to your requests, execute agreements with you, provide you with products you order, and manage your transactions.

Cookies and Tracking Technologies: You may disable certain cookies and tracking technologies at any time by adjusting your browser settings or taking other actions to opt out of cookies and tracking technologies. Please be aware, however, that if you disable cookies, you may not be able to take full advantage of all of the features of our Services.

Privacy Rights under Certain Laws: In some locations, including the European Economic Area, the United Kingdom, and California, privacy or data protection laws may give you certain rights with respect to your Personal Data. These rights include the right to know what Personal Data we process about you and to request access to it, to correct inaccuracies or update Personal Data, to ask us to delete Personal Data, or obtain a copy of your Personal Data. You also may have the right to object to, opt out of, or ask that we restrict our processing of your Personal Data. When we ask for your consent to Personal Data processing, you may withdraw your consent at any time. Kleos Health will not discriminate against you for exercising a privacy right granted to you by law.

To find out more about your legal rights or to exercise any privacy rights that apply to you, please contact us at privacy@cardinalhealth.com or 800.926.0834 (free of charge in the United States). In your email, please include your full name, zip code or postal code, the email address at which you prefer to be contacted, and the privacy right(s) you are requesting, such as the removal of information about a particular transaction or the correction of specific information. Please check your incoming email messages in case we need to ask you more questions about your request.

Certain laws allow an authorized agent acting on your behalf to make privacy requests, which they may do by following the instructions above. If an authorized agent submits a request for you, we may ask you to verify your own identity or confirm the request directly with us.

Subject to appropriate verification of your identity, which may include asking you for additional information to match the information we have, Kleos Health will honor the privacy rights provided to you by applicable law. You can expect that Kleos Health will respond to your privacy request within the required time period under applicable law, unless we reach out to explain that it will take us longer. If we cannot fulfill your privacy request in whole or in part, we will explain why. It is our policy not to disclose any information in response to a privacy request that may adversely affect the privacy of other persons unless legally required to do so.

If you have any questions about our response to your privacy request, please contact us at privacy@cardinalhealth.com. While we will always try to assist when you have concerns about the privacy of your Personal Data and appreciate an opportunity to do so, if you have concerns about how we manage your Personal Data or respond to your requests, you may be able to file a complaint with your local data protection authority or privacy regulator.

6. Links to Other Services

For your convenience and information, our Services may contain links to other websites and apps unaffiliated with Kleos Health. We do not control or monitor and are not responsible for the privacy practices or the content of these websites and apps we link to. We urge you to review the relevant privacy policies prior to use to ensure that you are comfortable with their privacy practices.

7. Security of Our Services

Kleos Health takes appropriate steps to manage the privacy of your Personal Data and the security of the Services. Despite these efforts, it is impossible to guarantee 100% security in all circumstances.

8. Retention of Personal Data

Kleos Health retains Personal Data as long as necessary to fulfill the purposes for which your Personal Data was collected, unless a longer retention period is necessary, the Personal Data is required to fulfill a legal obligation, or we are otherwise permitted to retain the Personal Data for other uses. For example, we generally retain Personal Data used for:

• Managing your account for as long as the account is active and for a period afterward that may correspond to any period allowed for returns, recalls, or other administrative needs related to the products or services purchased

• Communications with you for as long as you permit us to communicate with you for purposes of direct marketing or for the length of time necessary to provide administrative or transactional communications related to products or services purchased from us

• Security and integrity for the length of time the Personal Data is useful for enhancing the security of our Services; as needed in connection with our obligations to protect our Services or products from fraud, malicious, or illegal activity; to meet our legal obligations; or to ensure our rights and those of others as well as our policies are enforced

Where Personal Data is used for more than one purpose, we will retain the Personal Data until the purpose with the longest retention period expires.

9. Children’s Privacy

Kleos Health does not expect that any portion of its Services will be used by persons under the age of 16, and we do not knowingly collect Personal Data from anyone under the age of 16.

10. Additional Information for US Consumers

Residents of certain US states (“consumers”), including California, have rights under comprehensive state privacy laws, such as the California Consumer Privacy Act.

California Privacy Rights

In addition to the rights described above, California residents may ask us for information about our processing of their Personal Data, including the categories and sources of Personal Data, our purposes for processing Personal Data, and how we disclose Personal Data to others.

Our Legal Bases for Processing Personal Data

Some data protection laws require us to designate one or more legal bases for processing your Personal Data. When applicable, Kleos Health relies on the following legal bases:

• Contractual Obligations. We use Personal Data to provide the products or services you request, including by establishing your Kleos Health account; validating your access to our Services; processing your purchase orders; providing customer service; and sending you administrative or transactional communications.

• Our Legitimate Interests. We use Personal Data when we have legitimate interests in doing so, as long as our legitimate interests are compatible with your rights and expectations of privacy. We rely on our legitimate interests to operate, maintain, and improve the Services and our products; perform analytics and conduct customer research; and improve our customer service and overall user experience.

• Our Legal Obligations. We use Personal Data as needed to comply with our legal obligations, including as needed for fraud prevention; public safety; complying with public authorities and courts; and enforcing or defending our rights and those of others.

• Your Consent. We may use Personal Data as described in this Privacy Notice with your “opt-in” consent, including when needed for marketing communications and tracking technology use. When you consent, you may opt out at any time by contacting us at support@kleoshealthcare.com.

11. Changes to this Privacy Notice and Contacting Us

We reserve the right to modify this Privacy Notice at any time. You can see when this Privacy Notice was last revised by referring to the date it was “Last Updated” at the top of the Privacy Notice.

If you have any questions or comments about our privacy practices or this Privacy Notice, please contact us at:

Email: support@kleoshealthcare.com

Telephone: +1 (604) 353-5582

Mail:

Kleos Health Inc.

300-10991 Shellbridge Way,

Richmond, BC,

Canada, V6X 3C6