Privacy Policy

It does not apply to information collected by:

• Us offline or through any other means, including on any other website operated by Company or any third party (including our affiliates and subsidiaries); or
• Any third party (including our affiliates and subsidiaries), including through any application or content (including advertising) that may link to or be accessible from or through the Website.

If you use our Services in a manner that results in the collection, creation, receipt, transmission, or maintenance of Protected Health Information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), we will handle such PHI in accordance with HIPAA, any applicable Business Associate Agreement ("BAA"), and the HIPAA section below. Where there is a conflict between this Privacy Policy and an applicable BAA, the BAA will control with respect to PHI.

Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Services. By accessing or using the Services , you agree to this privacy policy. This policy may change from time to time (see Changes to Our Privacy Policy). Your continued use of the Services after we make changes is deemed to be acceptance of those changes, so please check the policy periodically for updates.

Children's Privacy

Our Website is not intended for children under 13 years of age (U.S.) or under 16 years of age (EU/UK) (collectively the "Children" and each individually a "Child"). We do not knowingly collect personal information from Children. However, some clinics may provide dependent/child data, which we process, where applicable, under HIPAA. If you are a Child, do not use or provide any information on our Website, through any of its features, or through any of the other Services, or register on the Website, make any purchases through the Website, use any of the interactive or public comment features of this Website, or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received personal information from a Child without verification of parental consent, we will delete that information. If you believe we might have any information from or about a Child, please contact us at privacy@onconexus.ai.

California residents under 16 years of age may have additional rights regarding the collection and sale of their personal information. Please see Your State Privacy Rights for more information.

Information We Collect About You and How We Collect It

We collect several types of information from and about users of our Website, including information:

• By which you may be personally identified, such as name, postal address, email address, telephone number, or any other identifier by which you may be contacted online or offline ("personal information");
• That is about you but individually does not identify you; and/or
• About your internet connection, the equipment you use to access our Website, and usage details (i.e., log data, device information, browser type and IP address).
• Financial information, payment details processed through secure-third party providers.
• Sensitive data, including health information and PHI processed, biometric data, government identifiers, or other information defined as sensitive under applicable law (collected only where strictly necessary and with your consent, where required), when healthcare providers use our platform. This may include clinical information contained within visit documentation, encounter audio records, transcripts, and AI-generated clinical documentation created during healthcare encounters. PHI is handled in accordance with HIPAA and any applicable BAA.
• Cookies and tracking data as described in our Cookie Policy located here: https://onconexus.ai/cookie-policy.

Health Information Processed Through the Platform

When our Services are used by healthcare providers, we may process clinical information on behalf of those healthcare providers. The information processed through the platform may include:

• Encounter audio recordings captured during patient visits;
• Transcripts generated from encounter audio;
• AI-generated clinical documentation (such as Visit Action Plans);
• Patient summaries containing next steps and care instructions;
• Suggested ICD-10 codes and clinical documentation associated with patient visits;
• Care coordination tasks and workflow assignments created during clinical documentation.

These records may contain information discussed during a clinical visit, including diagnoses, medications, treatment discussions, laboratory references, or other clinical information included within the structured visit documentation.

We may also process patient identifiers provided by healthcare providers, including:

• Patient name;
• Date of birth;
• Medical Record Number (MRN);
• Email address;
• Phone number (optional); and
• Address (optional).

We collect this information:

• Directly from healthcare providers or clinic staff using the platform, including through real-time audio, recording of patient visits, entry of patient record information, or submission of information through platform workflows.
• Through automated processing of recorded encounter audio to generate transcripts, clinical documentation, and structured workflow tasks.
• Automatically as you navigate through the site. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies.
• From third parties, for example, our business partners.

Information You Provide to Us

The information we collect on or through our Website or other utilization of our Services may include:

• Information that you provide by filling in forms on our Website. This includes information provided at the time of registering to use our Website, subscribing to our service, posting material, or requesting further services. We may also ask you for information when you enter a contest or promotion sponsored by us, and when you report a problem with our Website.
• Records and copies of your correspondence (including email), if you contact us.
• Details of transactions you carry out through our Website or through utilization of our Services and of the fulfillment of your orders. You may be required to provide financial information before placing an order through our Website.
• Your search queries on the Website or our Services.
• Information entered or recorded by healthcare providers using the platform in connection with patient encounters.
• Audio recordings of patient visits captured by healthcare providers using the platform. Healthcare providers are responsible for obtaining any legally required patient consent prior to recording a clinical encounter. Before the recording begins, the platform displays a confirmation prompt requiring the provider to acknowledge that the patient has been informed of, and consented to, the recording. This acknowledgement is logged in the platform audit trail.

You also may provide information to be published or displayed (hereinafter, "posted") on public areas of the Website, or transmitted to other users of the Website or third parties (collectively, "User Contributions"). Your User Contributions are posted on and transmitted to others at your own risk. Although we limit access to certain pages/you may set certain privacy settings for such information by logging into your account profile, please be aware that no security measures are perfect or impenetrable. Additionally, we cannot control the actions of other users of the Website with whom you may choose to share your User Contributions. Therefore, we cannot and do not guarantee that your User Contributions will not be viewed by unauthorized persons.

Information We Collect Through Automatic Data Collection Technologies

As you navigate through and interact with our Website and through utilization of our Services, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns. Please see our Cookie Policy, which explains what cookies are, how we may use them and your choices regarding cookies, located here: https://onconexus.ai/cookie-policy.

HIPAA; Our Role as a Business Associate

This section only applies when our Services involve PHI, such as when we provide services to healthcare providers, clinics, or health plans, or when you directly provide PHI through health-related features.

Our Role Under HIPAA

When we directly provide services to healthcare providers, oncology clinics, or healthcare organizations ("Covered Entities"), we operate as a business associate ("Business Associate") under HIPAA.

As a Business Associate, we create, receive, maintain, or transmit PHI on behalf of Covered Entities in connection with the services we provide.

Covered Entities remain responsible for direct patient relationships and for responding to patient rights under HIPAA. We provide technical assistance to Covered Entities, such as exporting records, providing audit logs, or implementing requested amendments, at the direction of the Covered Entity.

Your Rights Regarding Your PHI

HIPAA gives individuals rights over their PHI, including rights to access, request amendment of, request restrictions on, and receive an accounting of certain disclosures of their PHI. Because we are a Business Associate and not a Covered Entity, these rights are exercised through your healthcare provider, which is the Covered Entity that maintains your medical record and issues the Notice of Privacy Practices applicable to your PHI. If you contact us directly with a request regarding your PHI, we will forward your request to your healthcare provider and respond only at its direction, consistent with our BAA. You may also file a complaint with us or with the U.S. Department of Health and Human Services without fear of retaliation.

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal information, to:

• Present our Website and its contents to you, and to provide, maintain and improve our Services.
• Provide you with information, products, or services that you request from us, fulfill any other purpose for which you provide it, and to personalize user experiences.
• Provide you with notices about your account or subscription, including expiration and renewal notices.
• Carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection (i.e., process transactions, subscriptions and payments).
• Notify you about changes to our Website or any products or services we offer or provide through it.
• Allow you to participate in interactive features on our Website and through utilization of our other Services.
• In any other way we may describe when you provide the information.
• To conduct analytics and performance measurement.
• For any other purpose with your consent.

We may also use your information to contact you about our own and third-parties' goods and services that may be of interest to you. If you do not want us to use your information in this way, please adjust your user preferences in your account profile. For more information, see Choices About How We Use and Disclose Your Information.

We may use the information we collect to analyze platform performance, understand how our Services are used, and improve product functionality and user experience.

Use of De-Identified and Aggregated Data

We may create and use de-identified or aggregated datasets derived from clinical documentation provided through the platform.

De-identification is performed in accordance with the HIPAA Safe Harbor method, which removes specified identifiers so the data cannot reasonably be used to identify an individual. We may use de-identified data for purposes including:

• Improving platform functionality and AI accuracy;
• Product development and quality improvement;
• Benchmarking and performance analytics; and
• Research and statistical analysis.

De-identified data may also be used in aggregated reports, marketing materials, or investor communications where no individual patient or clinic can be identified.

Disclosure of Your Information

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction. We disclose PHI only as permitted by HIPAA and any applicable BAA.

We may disclose personal information that we collect or you provide as described in this privacy policy:

• To our subsidiaries and affiliates.
• To contractors, service providers, and other third parties we use to assist us in operating and supporting the Services, such as providers of cloud hosting, transcription, artificial intelligence processing, authentication, and system infrastructure.
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our Website users is among the assets transferred.
• To third parties to market their products or services to you if you have not opted out of these disclosures. For more information, see Choices About How We Use and Disclose Your Information.
• To fulfill the purpose for which you provide it.
• To communicate with healthcare professionals providing your care.
• To improve services, evaluate performance, conduct internal audits, and support essential business operations.
• For any other purpose disclosed by us when you provide the information.
• With your consent.

We may also disclose your personal information:

• To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
• To enforce or apply our Terms of Service or terms of sale and other agreements, including for billing and collection purposes.
• To support medical research when permitted by HIPAA or with appropriate approvals.
• To protect against fraud, abuse and security risks.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of the Company, our customers, or others.

Choices About How We Use and Disclose Your Information

We strive to provide you with choices regarding the personal information you provide to us. We have created mechanisms to provide you with the following control over your information:

• Tracking Technologies and Advertising. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of this site may then be inaccessible or not function properly.
• Disclosure of Your Information for Third-Party Advertising. PHI is not permitted to be disclosed to third-party advertising without your written authorization. If you do not want us to share your personal information with unaffiliated or non-agent third parties for promotional purposes, you can opt-out by checking the relevant box located on the form on which we collect your data. You can also always opt-out by logging into the Website and adjusting your user preferences in your account profile, or by sending us an email with your request to email: privacy@onconexus.ai.
• Promotional Offers from the Company. PHI is not permitted to be disclosed without your written authorization. If you do not wish to have your contact information used by the Company to promote our own or third parties' products or services, you can opt-out by checking the relevant box located on the form on which we collect your data. You can also always opt-out by logging into the Website and adjusting your user preferences in your account profile, or by sending us an email with your request to email: privacy@onconexus.ai. If we have sent you a promotional email, you may send us a return email asking to be omitted from future email distributions.

We do not control third parties' collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can opt out of receiving targeted ads from members of the Network Advertising Initiative ("NAI") on the NAI's website.

Residents of certain states, such as California, Nevada, Colorado, Connecticut, Virginia, and Utah may have additional personal information rights and choices. Please see Your State Privacy Rights for more information.

Accessing and Correcting Your Information

You can review and change your personal information by logging into the Website and visiting your account profile page.

If you delete your User Contributions from the Website, copies of your User Contributions may remain viewable in cached and archived pages, or might have been copied or stored by other Website users. Proper access and use of information provided on the Website, including User Contributions, is governed by our Terms of Service.

Your State Privacy Rights

State consumer privacy laws may provide their residents with additional rights regarding our use of their personal information. These rights may include the right to (i) access the personal information we maintain about you; (ii) correct inaccurate personal information; (iii) delete personal information we have collected from you; (iv) opt out of certain uses or disclosures of personal information, such as targeted advertising, the "sale" or "sharing" of personal information, or certain profiling activities; (v) receive a copy (portability) of your personal information in a usable format; (vi) limit the use and disclosure of sensitive personal information, where required by law; and (vii) appeal our decision if we decline to process your request.

To learn more about California residents' privacy rights, visit https://oag.ca.gov/privacy/ccpa.

Colorado, Connecticut, Virginia, and Utah each provide their state residents with rights to:

• Confirm whether we process their personal information.
• Access and delete certain personal information.
• Data portability.
• Opt-out of personal data processing for targeted advertising and sales.

Colorado, Connecticut, and Virginia also provide their state residents with rights to:

• Correct inaccuracies in their personal information, taking into account the information's nature processing purpose.
• Opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects.

To exercise any of these rights please send email to: privacy@onconexus.ai. To appeal a decision regarding a consumer rights request please send email to: privacy@onconexus.ai.

Nevada provides its residents with a limited right to opt-out of certain personal information sales. Residents who wish to exercise this sale opt-out rights may submit a request to this designated email: privacy@onconexus.ai. However, please know we do not currently sell data triggering that statute's opt-out requirements.

We will not discriminate against you for exercising your privacy rights.

EU/UK Data Subjects (GDPR):

Residents of European Union (EU) or United Kingdom (UK) have specific rights under applicable data protection laws. These include:

• Rights of access, rectification, erasure, and portability;
• Right to restrict or object to processing;
• Right to withdraw consent at any time; and
• Right to lodge a complaint with a supervisory authority.

To exercise your rights, contact us at privacy@onconexus.ai.

Legal Bases for Processing:

Where required by law within European Economic Area (EEA), UK, or other jurisdictions requiring a legal basis for processing, we rely on the following legal bases:

• Contract performance;
• Legal obligations;
• Legitimate interests (e.g., improving Services, preventing fraud, etc.); and
• Consent (where required, e.g., sensitive data, marketing, etc.).

Data Retention

We retain information according to the following schedules:

• Encounter Audio Recordings: approximately seven (7) days after recording and then permanently deleted.
• Transcripts and Visit Action Plans: seven (7) years as part of the clinical documentation record.
• Patient Summaries: seven (7) years.
• Activity and audit logs: at least six (6) years in accordance with HIPAA.
• Clinic staff accounts: retained while a clinic subscription remains active. After termination of service, account data may be retained for ninety (90) days for retrieval purposes before permanent deletion.

Certain healthcare records cannot be deleted during legally required retention periods.

Data Security

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. All information you provide to us is stored on our secure servers behind firewalls. Any payment transactions will be encrypted using SSL technology. Security controls include:

• Encryption of data in transit and at rest;
• Role-based access control and least-privilege permissions;
• Multi-factor authentication;
• Detailed access and activity logging;
• Secure key management; and
• Vendor security review and contractual safeguards.

These measures are designed to support compliance with the HIPAA Security Rule.

The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Website, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to our Website. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Website. Notwithstanding, we shall promptly notify you, or as a Business Associate, the Covered Entity, should a breach involving your unsecured PHI occur. PHI use and disclosure will be limited to only the minimum amount necessary.

Changes to Our Privacy Policy

It is our policy to post any changes we make to our privacy policy on this page. If we make material changes to how we treat our users' personal information, we will notify you either by email to the email address specified in your account or through a notice on the Website home page. The date the privacy policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our Website and this privacy policy to check for any changes.

Contact Information

To ask questions or comment about this privacy policy and our privacy practices, contact us at:

Address: 4539 N. 22nd St #4296, Phoenix, AZ 85016

or E-Mail: privacy@onconexus.ai