Privacy Policy.

1. Introduction

This Privacy Policy explains how MatriArch Technologies Inc. (“MatriArch,” “Company,” “we,” “us,” or “our”) collects, uses, stores, protects, and shares information when you access or use MatriArch Nexus™ and related websites, applications, dashboards, APIs, pilot programs, support workflows, training materials, and services.

By using MatriArch Nexus™, you acknowledge this Privacy Policy. Your use of the service is also governed by our Terms of Use and any applicable pilot agreement, consent form, Business Associate Agreement, data processing agreement, or enterprise agreement.

2. Scope of This Policy

This Privacy Policy applies to information we collect through MatriArch Nexus™. Different privacy rules may apply depending on how the service is used. For example, we may act as a direct-to-consumer health technology platform in some contexts and as a service provider or Business Associate to a healthcare organization in other contexts.

If we process Protected Health Information (“PHI”) on behalf of a HIPAA-covered healthcare provider, health plan, healthcare clearinghouse, or another Business Associate, the applicable Business Associate Agreement, healthcare organization’s Notice of Privacy Practices, and HIPAA-required terms may control where they conflict with this Privacy Policy.

3. Information We Collect

We may collect the following categories of information, depending on the features you use and the context in which the service is deployed:

• Account and contact information: name, email address, phone number, account identifiers, organization affiliation, role, authentication provider information, login metadata, and communication preferences.
• Profile and family information: household profiles, relationship labels, dependent or family-related records, caregiver roles, delegated access context, emergency contact context, and family care coordination details.
• Health-related information: journal entries, symptoms, severity values, event timelines, baseline notes, menstrual or cycle-day information where entered, medication schedules, medication check-ins, supplements, allergies, side effects, weight entries, appointments, care routines, tags, care notes, files, attachments, and other information you choose to provide.
• Care coordination information: shared notes, care preparation summaries, task status, provider or care-team context, family access permissions, care-plan context entered by users, and sharing activity.
• Connected-system information: information imported from or exchanged with healthcare systems, patient portals, health information exchanges, interoperability networks, labs, pharmacies, scheduling systems, identity providers, APIs, or other third-party systems when authorized, enabled, or required for a pilot or integration.
• AI and analytics information: prompts, inputs, summaries, suggested tags, baseline comparisons, pattern observations, care-preparation prompts, AI-generated outputs, model interaction metadata, and quality or safety review records.
• Pilot and enterprise program information: pilot enrollment status, organization name, user role, onboarding progress, training attendance, support requests, feedback, feature usage, adoption activity, workflow completion data, satisfaction responses, operational impact data, estimated time-savings data, ROI-related metrics, and outcome-measurement data.
• Technical and device information: device type, browser type, operating system, IP-related information, approximate location derived from technical signals, log data, error reports, security events, access timestamps, and usage activity.
• Consent and audit records: consent status, consent scope, policy version, timestamp, user ID, revocation records, authorization records, access grants, share events, and audit-oriented activity logs.
• Communications and support information: messages, support tickets, training questions, product feedback, survey responses, and administrative communications.

4. Sources of Information

We may collect information directly from you; from authorized family members, caregivers, or delegates; from pilot sponsors or enterprise customers; from healthcare organizations or care teams; from connected systems that you or an authorized organization enable; from service providers that support the platform; and automatically from your device or browser when you use the service.

5. How We Use Information

We use information to provide, secure, maintain, evaluate, and improve MatriArch Nexus™, including to:

• Create and manage accounts, profiles, family records, permissions, and consent settings.
• Save and display health journals, symptom logs, medication context, appointments, care routines, event timelines, and care coordination records.
• Generate informational insights, baseline comparisons, summaries, suggested tags, care-preparation prompts, and other AI-supported features when enabled.
• Support family-centered workflows, caregiver collaboration, care-team sharing, and user-directed data exchange.
• Operate pilot programs, onboarding, training, support, adoption tracking, customer success reporting, outcome-measurement dashboards, and ROI analysis.
• Monitor system performance, troubleshoot issues, respond to support requests, prevent misuse, investigate security events, and protect the integrity of the service.
• Comply with applicable legal, contractual, audit, reporting, and regulatory obligations.
• Develop, test, improve, and validate features, workflows, dashboards, and safety controls.

6. Health Data, PHI, and Consumer Health Data

MatriArch Nexus™ may process health-related information that is sensitive. Depending on the context, this information may be Protected Health Information under HIPAA, consumer health data under state privacy laws, personal information, or other regulated data.

When we process PHI as a Business Associate, we use and disclose PHI only as permitted by the applicable Business Associate Agreement, HIPAA, and other applicable law. When health-related information is not governed by HIPAA, we still treat it as sensitive and use it only as described in this Privacy Policy, as directed by you, or as otherwise permitted by applicable law.

7. HIPAA and Healthcare Relationships

MatriArch Technologies Inc. may not be a HIPAA covered entity in all contexts. If we provide services to or on behalf of a HIPAA-regulated healthcare organization, we may act as a Business Associate and additional HIPAA terms may apply. Nothing in this Privacy Policy creates a provider-patient relationship, physician-patient relationship, nurse-patient relationship, therapist-patient relationship, or other clinical relationship between you and MatriArch.

If your healthcare provider, health plan, or pilot sponsor has a separate privacy notice, consent form, authorization, or Notice of Privacy Practices, that document may describe additional rights and obligations. You should contact that organization directly to exercise rights that only it can fulfill, such as changes to records maintained in its electronic health record.

8. Pilot Program and Enterprise Sponsor Data

If you use MatriArch Nexus™ through a pilot, employer-sponsored, nonprofit-sponsored, healthcare-sponsored, or enterprise-sponsored program, we may collect and use pilot-related information to operate the pilot, provide training and support, measure adoption, evaluate workflow impact, prepare success metrics, and report on pilot outcomes.

We may provide pilot sponsors or enterprise customers with administrative dashboards or reports showing information such as user activation, training completion, support volume, feature usage, workflow completion, satisfaction trends, adoption metrics, estimated time savings, ROI indicators, and aggregated outcome indicators. Unless you direct us, applicable law allows it, or a governing agreement permits it, we do not disclose your personal journal entries, symptom details, medication details, family records, or other identifiable health content to a pilot sponsor solely for general adoption reporting.

Case studies, testimonials, press references, public customer stories, or marketing materials that identify you or disclose identifiable health information will require separate approval or consent.

9. AI Processing and Automated Insights

If you enable or participate in features that use artificial intelligence, your information may be processed to generate summaries, suggested tags, care-preparation prompts, baseline comparisons, pattern observations, and other informational outputs. AI outputs may be incomplete, inaccurate, or inappropriate for your circumstances and are not medical advice, diagnosis, treatment, emergency guidance, or a substitute for professional clinical judgment.

AI inputs, outputs, and related metadata may be stored, logged, reviewed, or evaluated to provide the feature, improve reliability, monitor safety, troubleshoot errors, maintain audit records, and comply with applicable obligations. We may use third-party AI, cloud, analytics, or infrastructure providers to process information on our behalf under contractual, security, and privacy controls.

We do not use identifiable health information to train public-facing AI models unless you or the applicable organization expressly consents, the data has been de-identified as permitted by law, or another lawful basis applies and is disclosed. You may be able to disable AI-related features or revoke AI-related consent where supported by the service and applicable law.

10. Sharing of Information

We do not sell your personal health information. We may share information in the following limited circumstances:

• At your direction: when you choose to share information with family members, caregivers, care teams, providers, pilot sponsors, or connected systems.
• With authorized family or caregiver users: according to the access controls, family roles, delegated permissions, consent settings, and sharing choices configured in the service.
• With healthcare organizations and connected systems: when needed to support authorized care coordination, interoperability, data import, data export, or pilot workflows.
• With pilot sponsors or enterprise customers: for onboarding, support, adoption reporting, security administration, outcome measurement, and contract management, subject to the limits described in this Privacy Policy and any applicable agreement.
• With service providers: with vendors that provide hosting, cloud infrastructure, authentication, security, analytics, support, communications, AI processing, payment, legal, compliance, or operational services on our behalf.
• For legal, safety, or security reasons: when required by law, legal process, court order, subpoena, regulatory request, security investigation, incident response, fraud prevention, or to protect rights, safety, and service integrity.
• In business transfers: in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate protections for sensitive information.
• With de-identified or aggregated data: when information has been de-identified or aggregated so that it does not reasonably identify you, subject to applicable legal requirements and contractual commitments.

11. Consent-Based Sharing and Family Access Controls

MatriArch Nexus™ uses a consent-based model for features that involve health-related information, AI processing, care-team sharing, family access, and connected-system workflows. You may be asked to grant, deny, update, or revoke consent for specific features or data flows.

If you enter, manage, import, or share information about another person, including a child, dependent, elder, family member, or person under your care, you represent that you have appropriate permission, authority, guardianship, caregiving authority, legal authorization, or another valid basis to do so. We may rely on your representations and consent settings when providing family and caregiver features.

12. Connected Systems, Interoperability, and Third-Party Integrations

MatriArch Nexus™ may connect with third-party systems such as healthcare providers, EHR platforms, patient portals, health information exchanges, interoperability networks, APIs, identity providers, labs, pharmacies, scheduling systems, analytics tools, or cloud services. These connections may allow information to be imported, exported, matched, requested, transmitted, displayed, or updated as part of authorized workflows.

Third-party systems are governed by their own privacy policies, security practices, contractual terms, and legal obligations. Once information is sent to a third party at your direction or under an authorized integration, that third party may control how it uses, maintains, corrects, deletes, or discloses the information.

13. De-Identified and Aggregated Information

We may create, use, disclose, and retain de-identified or aggregated information for product improvement, security, analytics, research, benchmarking, pilot evaluation, ROI analysis, operational reporting, investor or enterprise diligence, and business purposes. We will not attempt to re-identify de-identified information except as permitted by law, to validate de-identification, to investigate security issues, or as otherwise required or permitted by applicable agreements.

14. Cookies, Analytics, and Tracking Technologies

We may use cookies, pixels, local storage, software development kits, logs, and similar technologies to operate the service, keep users signed in, remember preferences, measure usage, improve performance, detect abuse, maintain security, and support analytics. Where required, we will provide choices or obtain consent for non-essential technologies.

We do not use personal health information for targeted advertising. We do not knowingly permit advertising technologies to collect identifiable health content from journal entries, symptom logs, medication records, family records, AI prompts, or care notes.

15. Communications

We may send administrative, security, support, onboarding, training, pilot, policy, and service-related communications. You may opt out of non-essential marketing communications, but you may still receive important service, legal, security, pilot, or account messages.

Do not use MatriArch Nexus™ to communicate emergencies or urgent medical conditions. The service is not monitored as an emergency communications channel. If you believe you may have a medical emergency, call emergency services immediately.

16. Cloud Infrastructure and Security

We use technical, administrative, and organizational safeguards intended to protect information, including authentication controls, role-based access controls, encryption in transit, encryption at rest where supported, audit-oriented logging, monitoring, vendor controls, incident response processes, and workforce access limitations. We design MatriArch Nexus™ with healthcare-grade security expectations in mind.

No system can be guaranteed completely secure. You are responsible for protecting your login credentials, using trusted devices and networks, maintaining appropriate access permissions, and promptly notifying us of suspected unauthorized access.

17. Data Retention, Deletion, and Backups

We retain information for as long as needed to provide the service, operate pilot programs, maintain records, support user-directed functionality, comply with legal or contractual obligations, resolve disputes, enforce agreements, protect security, maintain audit logs, and improve the service.

You may request deletion of your account or certain information where supported by the service and applicable law. Deletion may be limited or delayed when retention is required for legal, security, fraud-prevention, audit, backup, contractual, HIPAA, healthcare, or dispute-resolution reasons. Information may remain in encrypted backups or archival systems for a limited period before deletion or isolation through standard backup cycles. De-identified or aggregated information may be retained as permitted by law.

18. Your Choices and Privacy Rights

Depending on your location, account type, pilot context, and applicable law, you may have rights to request access, correction, export, deletion, restriction, consent withdrawal, opt-out of certain processing, or information about how your data is shared. You may also be able to manage family access, revoke care-team sharing, disable AI-supported features, update communication preferences, or request account deletion through available product settings or by contacting us.

When information is maintained by a healthcare provider, health plan, pilot sponsor, or other third party, you may need to contact that organization directly to exercise rights relating to records it controls.

19. Children, Dependents, and Guardianship

MatriArch Nexus™ is intended for use by adults and authorized guardians, caregivers, or legal representatives. The service is not directed to children for independent use. If information about a child, dependent, elder, or other individual is entered, imported, managed, or shared, the person doing so represents that they have the authority to provide and manage that information.

If we learn that a child has created an account without appropriate authorization, we may delete or restrict the account and related information as required by law and operationally feasible.

20. Security Incident and Breach Notifications

If we become aware of a security incident or breach involving information covered by this Privacy Policy, we will investigate and provide notices as required by applicable law, contractual obligations, Business Associate Agreements, and regulatory requirements. The timing, content, and recipient of notices may differ depending on whether the information is governed by HIPAA, state privacy laws, consumer health data laws, the FTC Health Breach Notification Rule, or another applicable requirement.

21. Third-Party Links

The service may contain links to third-party websites, applications, resources, or services. We are not responsible for the privacy practices, security practices, availability, accuracy, or content of third-party services that we do not control.

22. Changes to This Privacy Policy

We may update this Privacy Policy as our service, pilot programs, integrations, AI features, legal obligations, or business operations change. If changes are material, we may provide notice, update the “Last Updated” date, or require you to review and accept the updated policy before continuing to use certain features.

23. Contact

Questions, privacy requests, consent requests, data requests, or security concerns may be directed to MatriArch Technologies Inc. at: privacy@matriarchtech.com

This Privacy Policy is intended as a strong product-ready draft for pilot and early enterprise use. It should be reviewed by qualified privacy and healthcare technology counsel before hospital deployment, clinical integrations, payor use, enterprise procurement, or external fundraising diligence.