NOVA LiFE Privacy Policy

This Privacy Policy ("Policy") describes how NOVA LiFE App LLC ("NOVA LiFE," "we," "us," or "our") collects, uses, discloses, and protects your personal information when you access or use the NOVA LiFE mobile application (the "App"), including all related services, features, and content.

NOVA LiFE is an AI-powered recovery companion designed to support individuals in substance use disorder ("SUD") recovery. Because of the highly sensitive nature of the information we handle, we are committed to maintaining the appropriate standards of privacy protection under applicable federal and state law.

1. Introduction

We believe that privacy protection is fundamental to effective recovery support. Individuals in substance use disorder recovery need a safe, confidential space to be honest about their struggles, access support, and build healthier lives. This Policy is intended to help you understand exactly what data we collect, why we collect it, and how we protect it. If you have questions about anything in this Policy, please contact our Privacy Officer using the contact information in Section 19.

2. Who This Policy Applies To

The NOVA LiFE App serves three distinct categories of users, each subject to different regulatory frameworks depending on how they access the App:

2.1 Direct Consumer Users

Direct Consumer Users are individuals who download and use the NOVA LiFE App independently, without sponsorship by a health care provider or health plan.

2.2 Provider-Sponsored Users

Provider-Sponsored Users are individuals whose access to the NOVA LiFE App is facilitated, paid for, or directed by their health care provider, health plan, employee assistance program, correctional facility, or other entity sponsor (each, a "Sponsoring Organization").

2.3 Clinician Mode Users

Clinician Mode Users are health care providers, counselors, behavioral health technicians (BHTs), care coordinators, and other authorized personnel who access the NOVA LiFE App through a separate clinician login. Clinician Mode serves two purposes: (1) monitoring patient progress, receiving alerts, and coordinating care; and (2) using NOVA LiFE as a personal wellness tool for the clinician's own biometric tracking, journaling, and AI companion support (separate from patient data). If you are a Clinician Mode User:

• Your professional contact information and usage data are collected as described in this Policy.
• You are subject to your own organization's privacy policies and obligations with respect to patient data you access through the App.
• If you use Clinician Mode for your own personal wellness, your personal data (biometrics, journal entries, AI conversations) is kept separate from your professional patient-monitoring role and is not visible to your employer or the facilities you serve.
• Your access to patient information is governed by your professional license and the privacy, security, breach and interoperability laws that apply to you.
• Audit logs of your access to patient data are maintained in accordance with applicable legal requirements.

3. Information We Collect

We collect information necessary to provide, maintain, improve, and personalize the NOVA LiFE App. The categories of information we collect depend on which features you use and how you interact with the App.

3.1 Information You Provide

Account Information

When you create an account, we may collect your:

• Name (or chosen display name/pseudonym)
• Email address
• Phone number
• Date of birth (to verify you are 18 or older)
• Password and security credentials
• Profile preferences and settings

Recovery and Wellness Information

To personalize your recovery support, you may provide:

• Sobriety date and recovery milestones
• Substances of concern
• Recovery program affiliation (e.g., 12-step, SMART Recovery, faith-based)
• Treatment history (current and past treatment programs, medications)
• Personal goals and recovery objectives
• Mood and wellness check-in responses
• Journal entries

AI Chat Inputs

When you interact with Nova, our AI Companion, we collect:

• Text messages and voice-to-text transcriptions you send
• Context and conversation history necessary for continuity
• Feedback you provide on AI responses (e.g., thumbs up/down)
• Reported concerns or issues with AI responses

Life Story Data

Nova's persistent life-story memory feature involves a structured series of 31 to 52 questions designed to understand your unique recovery context. This data may include:

• Childhood and family history, including adverse childhood experiences
• Substance use timeline and progression
• Emotional inflection points and significant life events
• Relationship history and support systems
• Trauma history (disclosed voluntarily at your own pace)
• Coping mechanisms and triggers
• Values, beliefs, and motivational factors

This information is among the most sensitive data we collect. It is encrypted at rest, access is strictly limited, and it is never shared with third parties except as described in Section 8 of this Policy.

Payment Information

If you purchase a subscription or make in-app purchases, we collect:

• Payment card number (processed and stored by our PCI-DSS compliant payment processor; we retain only the last four digits)
• Billing address
• Transaction history
• Subscription status and plan details

3.2 Biometric Data

NOVA LiFE collects biometric data through three distinct technologies.

rPPG Camera Scanning

Our remote photoplethysmography (rPPG) feature, powered by third-party facial rPPG technology, uses your device's front-facing camera to measure physiological indicators without physical contact. A single, brief scan can produce many health markers, including:

• Heart rate (HR) and heart rate variability (HRV)
• Respiratory rate
• Other calculated biomarker estimates

On-Device Processing: Video frames captured during rPPG scanning are processed entirely on your device in real time and are not retained after the measurement ends. No video recordings or raw image data are transmitted to NOVA LiFE servers or any cloud service. Only the derived numerical health markers (e.g., heart rate value of 72 bpm) are transmitted to our servers for storage, trend analysis, and personalization.

Voice Biomarkers

Our voice biomarker technology, powered by third-party voice analysis technology, analyzes acoustic properties of your speech to detect cognitive and emotional signals. This includes:

• Ambient-listening cognitive signal analysis during interactions with the App
• Detection of mood shifts, anxiety indicators, and depression markers
• Speech pattern analysis corresponding to 13 Current Procedural Terminology (CPT) codes
• Vocal biomarker trends over time

Voice biomarker analysis evaluates acoustic properties (pitch, cadence, energy, spectral features) rather than the semantic content of your speech. Voice audio is captured on your device and sent over an encrypted connection to our third-party voice analysis technology provider, which analyzes it and returns a score. Voice recordings are de-identified before transmission, meaning your name and account information are never sent with the audio. NOVA LiFE does not store raw audio. NOVA LiFE may transmit de-identified voice recordings to third-party technology partners for the purpose of developing, training, and improving AI/ML models designed to support health and wellness monitoring, substance-use detection, addiction relapse identification, and related recovery applications (collectively, "Voice AI Models"). Such third-party partners may use the resulting trained Voice AI Models for its own products and customers beyond NOVA LiFE. Substance-use and addiction-related inferences derived from voice data may constitute sensitive health information under applicable federal and state law, and NOVA LiFE applies appropriate safeguards to such data accordingly. Such inferences are generated by automated systems, not licensed healthcare professionals. They are not evidence of substance use, intoxication, or impairment and should not be relied upon for any medical, treatment, legal, or employment decisions.

Take-Home MAT Facial Recognition

For users enrolled in Take-Home Medication-Assisted Treatment (MAT) management, the App uses facial recognition technology to verify identity during medication dosing events. This includes:

• Facial geometry data used for identity verification
• Dosing confirmation timestamps
• Verification success/failure logs

Facial recognition data is used solely for the purpose of medication dosing verification and compliance documentation. It is not used for any other identification purpose, marketing, or profiling.

3.3 Substance Use and Treatment Information

NOVA LiFE collects information related to substance use disorder diagnosis, treatment, and recovery. Substance use and treatment information we collect may include:

• Substance use history and current use patterns
• Diagnosis information (e.g., Alcohol Use Disorder, Opioid Use Disorder)
• Treatment program enrollment and participation
• Medication-Assisted Treatment (MAT) information, including medication type, dosage, and compliance
• Counselor and provider notes (Clinician Mode)
• Drug testing results shared with the App
• Recovery progress metrics
• Relapse events and circumstances

3.4 Information Collected Automatically

When you use the NOVA LiFE App, we automatically collect certain technical and usage information:

Device Information

• Device type, model, and manufacturer
• Operating system and version
• Unique device identifiers (anonymized where possible)
• Screen resolution and display settings
• Available storage and memory
• Camera and microphone hardware specifications (relevant to biometric features)

Usage Information

• App feature usage patterns and frequency
• Session duration and timestamps
• Content Library items accessed
• Peer Support session participation (duration, not content)
• Navigation patterns within the App
• Feature preferences and settings changes

Approximate Location

• General geographic region derived from IP address (city or metropolitan area level)
• Time zone
• We do not collect precise GPS location data except when required for the NOVA Clear geo-fence handshake feature, and only with your explicit consent

Log Data

• IP address (truncated or hashed for storage)
• Access timestamps
• Error reports and crash logs
• Performance metrics

Types of Automated Technologies may include:

• Cookies. When you visit our App, we may store or recognize some information on your device in the form of a "cookie" or similar technology. A cookie is a text file that is placed on your device by a web page server, using functions provided by your web browser.
• Web Beacons (or Pixels). Parts of our App may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, single-pixel gifs, or pixels). Web beacons generally work in conjunction with cookies to register when a particular device visits a particular page.

Some of these automated technologies may be required for us to provide a specific feature or service through the App. For example, they allow us to display the App in the proper format or language or to authenticate registrations and transactions. Other cookies may provide a convenience feature to save you time. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies if you prefer. If you choose to decline cookies, you may not be able to fully experience the interactive features of the App. If we use automated technologies that are not necessary to our operation of the App, we may give you the opportunity to opt-out of their use.

3.5 Information from Third Parties

Sponsoring Organizations

If you are a Provider-Sponsored User, your Sponsoring Organization may provide us with:

• Your name and contact information for account provisioning
• Treatment program enrollment status
• Authorized service tier and feature access permissions
• Care team member identities for coordination
• Relevant treatment plan goals

NOVA Clear Integration

As part of NOVA Clear integration, we may receive:

• Geo-fence verification data (confirming your presence at authorized locations)
• Treatment compliance indicators
• Scheduling and appointment data
• Program participation metrics

Data exchange with NOVA Clear occurs through a secure, firewalled handshake protocol.

4. How We Use Information

We use the information we collect for the following purposes:

4.1 Providing and Maintaining the Service

• Operating the NOVA LiFE App and all its features
• Authenticating your identity and managing your account
• Processing transactions and managing subscriptions
• Delivering AI Companion (Nova) conversations and persistent memory
• Performing biometric scans and generating health markers
• Facilitating Peer Support classes and Telehealth sessions with credentialed clinicians, including sessions that may be billed to health insurance under applicable CPT codes
• Managing Take-Home MAT dosing verification
• Providing Content Library recommendations
• Coordinating with Sponsoring Organizations (Provider-Sponsored Users)
• Sharing with our subcontractors, vendors and service providers who help us operate the Service
• For any other purpose described to you through the App or that you consent to

4.2 Communication

• Sending service-related notifications (e.g., appointment reminders, feature updates)
• Responding to your inquiries and support requests
• Providing recovery milestone acknowledgments and motivational messages
• Delivering urgent safety and crisis notifications
• Assisting you with using the App and/or customizing your experience with the App

4.3 Safety and Crisis Intervention

We use information to identify and respond to indicators of imminent harm. For a detailed description of crisis intervention actions we may take, see Section 7 (Safety and Crisis Situations).

4.4 Improvement and Development

• Analyzing de-identified and aggregated usage patterns to improve App features, and for research and product improvement, clinical outcomes analysis, public health reporting, and other purposes permitted by law
• Conducting quality assurance and testing
• Developing new features and services
• Performing data analytics and supporting health care operations
• Measuring outcomes and effectiveness of recovery support tools
• Training, fine-tuning, validating, and improving our AI models and systems, including using personal information such as conversation data and behavioral data for these purposes
• Sharing de-identified voice recordings with third-party technology partners for the development and training of Voice AI Models (as described in Section 3.2).

4.5 Legal Compliance

• Complying with applicable federal and state laws, such as applicable data privacy, security and breach laws
• Responding to lawful legal process (e.g., subpoenas, court orders)
• Conducting internal audits and compliance monitoring
• Maintaining records required by applicable regulations
• Establishing or exercising our legal rights
• Defending against legal claims
• To a buyer or other successor of Nova Life in the event of a merger, divestiture, restructuring, reorganization, change of control, dissolution, or other sale or transfer of some or all of Nova Life's assets, including as part of a bankruptcy, liquidation, or similar proceeding
• As otherwise required or permitted by applicable law

4.6 AI Personalization

• Tailoring Nova's conversational responses to your recovery context and communication style
• Recommending Content Library materials based on your biometric state, engagement patterns, and recovery stage
• Generating relapse prediction insights from biometric drift patterns and content consumption
• Adapting support intensity based on detected risk factors

5. AI-Generated Insights and Personalized Content

NOVA LiFE uses artificial intelligence, machine learning, deep learning, and human simulation modalities (collectively, "AI") to generate insights and personalized content designed to support your recovery. By using the App, you consent to the AI-driven data processing activities described in this section. Your use of the App is voluntary; if you do not want your data processed in connection with AI, please do not use the App. This section explains how AI processes your data and the limitations of AI-generated outputs.

5.1 How AI Processes Your Data

Our AI systems analyze multiple data streams to provide personalized support:

• Conversational Context: Nova uses your chat history and life-story data to provide contextually relevant, empathetic responses tailored to your unique circumstances.
• Biometric Integration: When available, physiological data from rPPG scans and voice biomarkers inform content recommendations and risk assessments.
• Behavioral Patterns: Your engagement patterns, Content Library usage, and session timing contribute to understanding your recovery trajectory.
• Cross-Signal Analysis: Our relapse prediction system integrates biometric drift (e.g., declining HRV, elevated stress indices), content consumption patterns (e.g., reduced engagement), and conversational indicators to flag potential risk.

5.2 Limitations of AI-Generated Insights

You should be aware of the following important limitations:

• AI-generated insights are not medical diagnoses or clinical determinations. They are supportive tools intended to complement, not replace, professional treatment.
• Biometric measurements from rPPG scanning and voice analysis are estimates and may vary from clinical-grade measurements.
• Relapse prediction is probabilistic and may generate false positives or fail to detect actual risk.
• Nova is an AI and cannot provide the same support as a human counselor, sponsor, or clinician.
• AI responses are generated based on patterns in training data and your personal context; they may occasionally produce inaccurate or inappropriate responses.

5.3 AI Training, Fine-Tuning, and Validation

NOVA LiFE may use your personal information and de-identified and aggregated data derived from your personal information, including conversation content, behavioral data, and Life Story Data, to train, fine-tune, validate, and improve our AI systems and the NOVA LiFE App. De-identified voice recording data may also be shared with third-party technology partners for the development and training of Voice AI Models (as described in Section 3.2). Only de-identified data is shared for this purpose. Such partners may use the resulting trained models for their own products and customers. For Provider-Sponsored Users whose information constitutes Protected Health Information, AI training, fine-tuning, and validation uses only de-identified data in accordance with HIPAA de-identification standards (45 CFR 164.514(b)). This use supports the development of more effective recovery support tools and personalized experiences. By using the App, you consent to the use of your personal information for AI training, fine-tuning, and validation purposes as described in this section. If you do not want your data used for these purposes, please do not use the App.

5.4 Content Recommendations Based on Biometric State

The Content Library dynamically adjusts recommendations based on your current and trending biometric data:

• Elevated stress indices may trigger recommendations for guided breathing, meditation, EFT tapping, trauma-release yoga, frequency audio, or grounding exercises.
• Mood indicators suggesting low affect may surface motivational content, peer success stories, or prompts to connect with live support.
• Physiological patterns consistent with craving states may prioritize urge-surfing techniques and coping strategy content.
• Positive biometric trends may reinforce progress with milestone acknowledgments and recovery capital-building content.

You may opt out of biometric-driven content personalization at any time through App settings.

6. How We Handle AI Chat and Life Story Data

6.1 Persistent Memory

Nova maintains persistent conversational memory to provide continuity and depth in your recovery support. This means:

• Nova remembers prior conversations, allowing you to build on previous discussions without repeating yourself.
• Life-story data you share through the structured question series becomes part of Nova's understanding of your unique context.
• Emotional and experiential context from past sessions informs future interactions.
• Nova may reference prior conversations or known preferences to provide more personalized support.

Persistent memory is a core feature that enables Nova to function as a consistent companion rather than a series of disconnected interactions. You may request deletion of your conversation history at any time, though this will reset Nova's contextual understanding.

6.2 Storage and Security

AI chat and life-story data receive the highest level of protection within our systems:

• All conversation data is encrypted at rest using AES-256 encryption.
• Data is encrypted in transit using TLS 1.2 or higher.
• Access to conversation data is restricted to essential personnel with role-based access controls.
• Conversation data is stored separately from account identifiers and linked only through encrypted internal references.
• Life-story data undergoes additional access controls, requiring elevated authentication for any human access.
• Automated monitoring detects and alerts on unauthorized access attempts.

7. Safety and Crisis Situations

In limited circumstances involving imminent risk of serious harm, we may take action to protect your safety or the safety of others. In crisis situations, we may:

• Display crisis resources prominently within the App, including the 988 Suicide & Crisis Lifeline and 911.
• Offer one-tap calling to the 988 Suicide & Crisis Lifeline or 911.
• For Provider-Sponsored Users, notify the Sponsoring Organization's designated crisis contact as permitted under applicable law.

We do not monitor your entries in real time and cannot guarantee detection of every crisis. If you are in immediate danger, call 911.

8. How We Share Information

We share information only in the limited circumstances described below.

8.1 Service Providers and Professional Advisors

We engage third-party service providers to perform functions on our behalf. We also may disclose personal information to our professional advisors, such as attorneys, accountants, auditors, and insurance providers, where necessary to obtain professional services or advice, or as required in connection with legal proceedings, regulatory examinations, or insurance claims.

Certain third-party technology partners may receive de-identified voice recordings for the development and training of Voice AI Models (as described in Section 3.2). Only de-identified data is shared for this purpose, and such partners may use the resulting trained Voice AI Models for their own products and customers.

8.2 Sponsoring Organizations

For Provider-Sponsored Users, we may share information with your Sponsoring Organization, subject to our written agreement with the Sponsoring Organization and in compliance with applicable law.

Information shared with Sponsoring Organizations may include:

• Treatment engagement metrics (e.g., session frequency, feature utilization)
• Recovery progress indicators (de-identified where possible)
• Risk alerts (with appropriate consent for relapse prediction disclosures)
• MAT compliance data (dosing verification, adherence rates)
• Care coordination information relevant to your treatment plan

The Sponsoring Organization or people who work with them may share your personal information and other information with others if they are permitted to do so under the laws that apply to them. We cannot control how the Sponsoring Organization or other people who work with them use or share your personal information or other information. Please read the Sponsoring Organization's (e.g., your health plan's and your health care provider's) HIPAA Notice of Privacy Practices for more information about how your protected health information can be used and disclosed under HIPAA. You may request a copy from your Sponsoring Organization. If you have any questions or concerns about how your health plan or health care provider is managing your information, please contact them directly.

8.3 NOVA Clear Integration

If applicable for NOVA Clear integration, data exchange occurs through a secure, firewalled geo-fence handshake protocol:

• Data exchange is initiated only when your device is within a designated geo-fence zone associated with an authorized NOVA Clear facility.
• The handshake protocol verifies both device identity and facility authorization before any data is transmitted.
• Data transmitted to NOVA Clear is limited to treatment compliance indicators, appointment verification, and program participation metrics as specified in your consent.
• Data received from NOVA Clear is limited to scheduling information, program requirements, and authorized treatment coordination data.
• All NOVA Clear data exchanges are logged.

8.4 Legal Requirements

We may disclose information when required by law.

8.5 With Your Consent

We may share information with third parties when you have given consent for the disclosure.

8.6 Miscellaneous Disclosures

In addition to the disclosures described above, we may share your personal information in the following circumstances to the extent permitted by applicable law:

Corporate Transactions. We may disclose or transfer your personal information to a prospective or actual buyer, investor, successor, or other third party in connection with a proposed or completed merger, acquisition, financing, asset sale, divestiture, reorganization, change of control, dissolution, bankruptcy, liquidation, or similar corporate transaction involving all or part of NOVA LiFE.

Safety and Threat to Life. We may disclose personal information to appropriate authorities, emergency services, health care providers, family members, or other individuals when we reasonably believe disclosure is necessary to prevent or address an imminent threat to the life or physical safety of any person. For detailed information about our crisis intervention practices, see Section 7 (Safety and Crisis Situations).

Legal Compliance and Protection of Rights. We may disclose personal information when we believe in good faith that disclosure is necessary or appropriate to: (a) comply with applicable federal, state, or local laws, regulations, or legal process, including lawful requests from public authorities for national security or law enforcement purposes; (b) respond to subpoenas, court orders, warrants, government investigations, or other valid legal process; (c) establish, exercise, or defend our legal rights or claims; (d) enforce our Terms of Use, this Privacy Policy, or other agreements; (e) investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, security threats, or violations of our policies; or (f) protect the rights, property, or safety of NOVA LiFE, our users, or others.

Aggregated and De-Identified Information. We may create, use, and share aggregated, anonymized, or de-identified information that does not identify you as an individual. Such information may be shared with third parties for any lawful purpose, including research, analytics, benchmarking, product improvement, and industry reporting. De-identification is performed in accordance with applicable standards, including HIPAA de-identification requirements (45 CFR 164.514(b)), where applicable. Once information has been de-identified in accordance with applicable law, it is no longer considered personal information and may be used or disclosed without restriction under this Privacy Policy.

Affiliates. We may share personal information with companies that NOVA LiFE App LLC owns or controls ("affiliates"), for the purposes described in this Privacy Policy, including to provide and improve our services, for administrative and operational support, and to comply with applicable legal obligations. Any affiliate receiving your personal information will be bound by the terms of this Privacy Policy or privacy protections at least as protective as those described here. Affiliates do not include treatment providers, Sponsoring Organizations, or other customers, even if they share owners with NOVA LiFE. Those organizations receive information only as described in Sections 8.2 and 8.3.

9. Your Right to Make Requests

NOVA LiFE provides all users, regardless of user type, with the ability to submit the following requests regarding their personal information. These options are offered as part of our commitment to transparency and do not create any third-party beneficiary rights under any agreement between NOVA LiFE and a Sponsoring Organization. You may request to:

• Access the personal information we maintain about you
• Receive a copy of your data in a commonly used, machine-readable format
• Request correction of inaccurate or incomplete information
• Review your AI conversation history and life-story data
• View a log of all biometric data collection events
• Delete your personal information

To submit a request, use the App settings or contact our Privacy Officer. We will review and respond to requests in accordance with our internal policies. You may also manage your communication preferences at any time. Note: Certain communications are required for service delivery or legal compliance (e.g., security alerts, breach notifications, consent confirmations) and cannot be opted out of while your account remains active.

10. Data Retention and Deletion

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

10.1 Retention Periods by Data Category

Account Data

Account information (name, email, phone, credentials) is retained for the duration of your active account plus a post-termination period to facilitate account recovery and address post-termination inquiries.

Biometric Data

Derived biometric measurements (health markers, voice biomarker scores, facial recognition templates) are retained for the period necessary to provide trending and historical analysis features. Raw biometric inputs (video frames, audio recordings) are not retained beyond immediate processing. De-identified voice recordings shared with third-party technology partners for Voice AI Model training purposes are retained by such partners in accordance with the applicable agreement between NOVA LiFE and the partner. Because such data is de-identified, it is not subject to individual deletion requests.

AI Conversation Data

Conversation history with Nova is retained for the duration of your active account to support persistent memory functionality. Upon account deletion, conversation data is permanently erased within ninety (90) days, unless we are required to retain a copy to support compliance with applicable law or our agreement with a Sponsoring Organization. However, to the extent your data has been incorporated into aggregated datasets, used to train or improve our AI systems, or is maintained in backup systems for business continuity purposes, it may be infeasible to return or destroy such data, and NOVA LiFE may retain it subject to ongoing confidentiality protections.

Protected Health Information

For Provider-Sponsored Users, retention of Protected Health Information is governed by our Business Associate Agreement with the Sponsoring Organization and that Sponsoring Organization's notice of privacy practices. NOVA LiFE does not maintain a Designated Record Set (as defined under HIPAA) on behalf of your Sponsoring Organization unless otherwise agreed in writing. Your rights to access and amend your Protected Health Information under HIPAA should be directed to your Sponsoring Organization.

De-identified Data

De-identified and aggregated data may be retained indefinitely because it cannot be associated with any individual.

Legal and Compliance Records

Records required for legal compliance, including consent forms, breach notifications, audit logs, and legal hold materials, are retained for the period required by applicable law or regulation.

10.2 Deletion Process

When data reaches the end of its retention period or you request deletion:

• Active databases: Data is permanently deleted or irreversibly de-identified within ninety (90) calendar days.
• For Provider-Sponsored Users: deletion timelines for Protected Health Information are governed by the Business Associate Agreement between NOVA LiFE and your Sponsoring Organization, which may require deletion within thirty (30) calendar days of agreement termination.
• Backup systems: Data is purged from backup systems within one hundred and eighty (180) days or excluded from restoration in the event a backup is restored before purging is complete.
• Service provider systems: We instruct service providers to delete applicable data.
• Audit logs: A record that deletion occurred (without the deleted content) is maintained for compliance purposes.

11. Security

NOVA LiFE implements comprehensive security measures to protect your personal information against unauthorized access, disclosure, alteration, and destruction. Although the Company has these security measures on the App in place, it cannot guarantee your privacy. Please be aware that email and text messaging on your device's SMS (or other text messaging applications) are not secure (not encrypted) methods of communication. There is the risk that email messages and text messaging on your device's SMS (or other text messaging applications) could be intercepted or read by other people. If you email us, we will respond to you by email and that email communication will not be secure (not encrypted). Please do not use email to communicate with us about confidential matters. By using the App, you are agreeing to accept these risks and consent to receive unsecure communications.

12. Third-Party Sharing and Third Party Links

NOVA LiFE engages the following categories of third-party service providers, each operating under appropriate contractual agreements: (1) biometric technology providers; (2) cloud hosting and infrastructure; (3) AI service providers; (4) data analytics providers; (5) payment processors; and (6) telehealth and communication platforms.

NOVA LiFE may share de-identified voice recordings with third-party technology partners for the development and training of Voice AI Models (as described in Section 3.2). The data is de-identified before sharing, and such partners may use the resulting trained Voice AI Models for their own other products and customers.

The App may also contain links to websites that are owned or operated by third parties. If you click on a third party link, you will go to that third party website. We do not have control over third party websites and those websites do not operate under this Privacy Policy. You should review the privacy policies of third party websites before using them.

13. Users Outside the United States

The NOVA LiFE App is designed for and available only to users located within the United States. Our services, regulatory compliance framework, and data handling practices are based on United States federal and state law.

If you access the App from outside the United States:

• You do so at your own risk and are responsible for compliance with local laws.
• Your data will be transferred to and stored in the United States.
• You consent to the transfer, processing, and storage of your information in the United States, which may have different data protection standards than your jurisdiction.
• We do not represent that the App is appropriate or available for use in any jurisdiction outside the United States.
• We make no claims that the App complies with privacy or data protection laws of any jurisdiction outside the United States, including the European Union's General Data Protection Regulation (GDPR).

We reserve the right to restrict access to the App based on geographic location.

14. Do Not Track

Some web browsers and devices transmit "Do Not Track" (DNT) signals. Because there is no common industry standard for interpreting DNT signals, the NOVA LiFE App does not currently respond to DNT signals. We are not aware of, and do not knowingly allow, such third parties to track your activity over time on the App. However, we may share information about your App usage with the client who has authorized your use of the App and our service providers, contractors, affiliates, business partners, and other relevant third parties as described in this Privacy Policy.

15. Electronic Communications

We may need to contact you about the App, your activity on the App and our Services. Additionally, if you (or Sponsoring Organization) have chosen to provide the App with information about your health care provider's appointments, medications, prescription refills, and other matters related to your care, you may receive push notifications or text messages, reminding you of these events or asking you to open your App for details about these events. By giving us your contact information, you have agreed that Nova Life, as well as our affiliates, business partners, service providers and contractors, may contact you for these purposes. These communications may be done by automated dialing equipment and/or artificial or prerecorded messages. You may receive multiple messages each day. We do not charge for our short message service (SMS); however, regular message and data rates may apply from your mobile carrier. We are not responsible for any data transmission fees. You can opt out at any time by replying "STOP" to a text message or by contacting us at admin@NovaLifeApp.com. This opt-out process does not apply to live phone calls or emails, which may continue in case we need to reach you.

16. Optional Sign-In Services

The App may allow you to sign in using an account you already have with a third party, such as Apple, Google, or another identity provider (each an "Identity Provider"). If you choose to use one of these services, you authorize the Company and the Identity Provider to exchange the information necessary to authenticate your identity and enable account creation or access. Your use of any third-party sign-in service is subject to that Identity Provider's own terms of use and privacy policy(ies). For example, Apple's Sign in with Apple terms (https://www.apple.com/legal/privacy/data/en/sign-in-with-apple/ (opens in a new tab)) and Google's APIs Terms of Service (https://developers.google.com/terms (opens in a new tab)). The Company does not control and is not responsible for the acts or omissions of any Identity Provider. Your use of such third-party sign-in services is at your own discretion and risk.

17. App Terms of Use

Your use of the App is also subject to the Nova Life App Terms of Use. Any disputes related to this Privacy Policy will be governed by the applicable provisions of the Nova Life App Terms of Use, which are incorporated into this Privacy Policy by reference. For Provider-Sponsored Users, in the event of any conflict between this Privacy Policy and the agreement between NOVA LiFE and your Sponsoring Organization, the terms of that agreement shall govern to the extent of the conflict.

18. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We may notify you of material changes through the App, by email or by a push notification to the mobile phone number you provided to us. By agreeing to this Privacy Policy, you agree to receive such notifications. You can access the most current version of the Privacy Policy that applies to your use of the App through the App. You can also contact us at admin@NovaLifeApp.com for a copy. Unless otherwise specified by us, all changes will be effective upon being updated in the App. You should look at this Privacy Policy on a regular basis. The most recent "Effective Date" is posted at the top of this Privacy Policy. You agree to any changes to the Privacy Policy by your continued use of the App after the Effective Date. If you do not agree to the changes, you must stop using the App.

19. Contact Information

If you have questions, concerns, or requests related to this Privacy Policy or our data practices, please contact: