Gaja Health Privacy Policy

Last revised: March 16, 2021

1. OVERVIEW

This Privacy Policy describes the categories of information that Gaja Health, Inc. (“Gaja Health”, “we”, “our” or “us”) collect from users of the gogajahealth.com website, any web-based, computer based or mobile application (each an “App”) and any technology products or services provided, owned, or operated by Gaja Health(collectively, the “Service”). This Privacy Policy also explains how Gaja Health may use, disclose or share and protects such information, as well as your choices regarding it. The information we collect and the purposes for which we use or disclose or share it will depend to some extent on how you use the Service and how you interact with us. Throughout this Privacy Policy, “information” includes personal information about you.

PLEASE READ THIS PRIVACY POLICY AND THE TERMS OF SERVICE (THE “TERMS”) CAREFULLY. IF YOU DO NOT AGREE WITH THE PROVISIONS OF THIS PRIVACY POLICY OR THE TERMS, DO NOT ACCESS OR USE THE SERVICE. BY USING THE SERVICE, YOU AGREE TO THE PROVISIONS OF THIS PRIVACY POLICY AND THE TERMS.

2. INFORMATION COLLECTION

We may collect the following categories of information in the manner described below. We also can collect information about you through other individuals or our service providers, third parties and/or other parties in the manner described below.

a. We collect information from or about you and/or another individual and/or party when you use the Service.

Following are examples of ways in which you can use the Service:

To participate in, and otherwise in connection with, the Anthem Pilot Study by providing us and/or a service provider, third party and/or other party contact information (for example, full name, email address, postal address, telephone number and related preferences), demographic information (for example, date of birth, gender, preferred pronoun, marital status, ethnicity, religion and outreach preferences), quality of life information (for example, personal feelings of well-being), social support structure information (for example, household members and backgrounds, social support contact information, housing stability and sources of stress), medical and related information (for example, current primary care physician name and contact information, prior emergency department visits and history, existing chronic conditions, dietary restrictionsand food allergies) and information regarding personal and family finances (for example, expenses on food, medicine and/or other personal expenses and Anthem supplemental benefit allocation).

To create, use or make changes (for example, corrections, updates, or deletions) to your online account with us (for example, to provide user name, password, and any other information you provide such as content or comments);

To provide information through the Service and/or in connection with technology products and services relating to us and/or a service provider, third party and/or other party; and

Information when you contact or otherwise interact with us or a service provider and/or other party (for example, customer service and support, two (2)-way chats via the Gaja Health Member App (the “Member App”), your search queries on the Service (including without limitation, saved examples and general preferences related to recipe recommendations, self-care recommendations and nutrition tip recommendations in the Member App), requests for information, participation in surveys and questionnaires and reporting an issue with the Service).

b. We can receive information about you through other individuals or our service providers, third parties and/or other parties (for example, content or comments), which information can be used as described in this Privacy Policy.

c. We and/or our service providers, third parties and/or other parties can automatically collect other information from or about you, including:

An identifier that is unique to the device on which you install an App and some device identifiers may be persistent device identifiers, as well as certain software and hardwareinformation about your device;

Operating system;

Browser type;

Mobile network information;

Internet Protocol (IP) address;

Platform type;

Device type;

Software and hardware attributes;

Domain name of your Internet service provider;

Your geographic location;

Information regarding your access to and use of the Service;

and Anonymized information.

In addition, we and/or our service providers, third parties and/or other parties can automatically collect information about content viewed or downloaded, landing pages, browsing activity, dates and times of access, pages viewed, forms you complete or partially complete, search queries, whether you open an email, your two (2)-way chat activity via the Member App and your interaction with email communication and push notification content, error logs, and other similar information.

We and/or our service providers, third parties and/or other parties, can automatically collect such information via cookies, Web beacons, tags, persistent device identifiers, flash cookies or Local Shared Objects, application analytics software and other technologies. Please see Cookies and Other Technologies; Do Not Track below.

d. We can collect information about you from:Publicly accessible sources;

Other individuals (for example, healthcare providers and/or other caregivers); and

Our service providers, third parties and/or other parties (for example, healthcare providers and/or other caregivers).

e. We can combine any of the information we collect from or about you and use it and disclose or share it in the manner described in this Privacy Policy.

3. COOKIES AND OTHER TECHNOLOGIES; DO NOT TRACK

We and/or our service providers, third parties and/or other parties, use cookies, Web beacons, tags, persistent device identifiers, flash cookies or Local Shared Objects, application analytics software and other technologies. These technologies are used for tracking, analytics and personalization and optimization of the Service.

a. Cookies. Cookies are small text files that are stored on your computer.Persistent cookies remain on the user’s computer after the browser has been closed.Session cookies exist only during a user’s online session and disappear from the user’s computer when they close the browser software.You can instruct your browser to stop accepting cookies. But if you do not accept cookies, you may not be able to use all portions or all functionality of the Service. Please see www.allaboutcookies.org for additional information about cookies.

b. Web Beacons. Web beacons or tags (small images embedded into websites or emails that send information about your computer when you access or use the Service, or open an email we send to you) can be used either by us or a service provider, third party and/or other party.

c. Persistent Device Identifiers. Persistent device identifiers are unique strings that are associated with the mobile device that you use to connect to the Service. Persistent device identifiers can be modified or disabled by sophisticated users.

d. Flash Cookies or Local Shared Objects. We can use flash cookies or Local Shared Objects.

e. Service providers, third parties and/or other parties may collect personally identifiableinformation about an individual user's online activities over time and across different Internet services when a user uses the Service.

f. Below are links to resources regarding analytics: For Tableau, please see https://www.tableau.com/privacy and https://www.tableau.com/tos.

g. Do Not Track. At this time, we do not respond to “Do Not Track” signals sent from Web browsers or other mechanisms that provide users the ability to exercise choice regarding the collection of personally identifiable information about a user’s online activities over time and across service provider, third party and/or other party Internet services.Please see Information Collection above and Information Use, Disclosing or Sharing Information, Children’s Privacy, Storage, Retention and Choices Regarding Your Information below.

4. INFORMATION USE

We can use the information that we collect from and about you to conduct our business and for any of the purposes described in this Privacy Policy, subject to applicable law.Examples are as follows.

a. To conduct the Anthem Pilot Study. To conduct the Anthem Pilot Study.

b. To Provide You with Technology Products and Services and Information. To provide you or facilitate providing you with technology products and services and information, maintain and service your online account or accounts, manage and store your information and provide technical support.

c. To Communicate with You. To communicate with you to provide information, content, Service-related notifications and recommendations.

d. To Respond to You. To respond to you, such as when you contact us, make a request or inquiry, complete a survey or questionnaire or share a comment or concern.

e. To Provide Quality Assurance and Carry Out Audits. To provide quality assurance and carry out audits.

f. For Personalizationof Your Experiences with Us. For personalizationof your experiences with us, including to remember your interests and preferences, customize the technology products and services we share with you, facilitate your interactions with us, track and categorize your activity and interests on the Service.

g. To Analyze and Interpret Key Trends and Messages regarding the Anthem Pilot Study. To analyze and interpret key trends and messages regarding the Anthem Pilot Study.

h. For Analytics. For analytics, including to understand how you use the Service, to determine how you access the Service, to improve the Service, to measure engagement and satisfaction with the Member App and with any other Gaja Health product or service, for research and development and/or fixing errors, by Gaja Health ora service provider, third party and/or other party, subject to applicable law.

i. For our Business Purposes. For our business purposes, such as to operate and improve upon our business and lawful business activities, to maintain our accounts and records, research and development (including without limitation, marketing research), product and service improvement and development, fixing errors, to determine your satisfaction with our technology products and services, information security, to detect and prevent fraud or misuse of our technology products and services and for any other business purpose that is permitted by applicable law.

j. For Legal and Safety Purposes. For legal and safety purposes, including to defend or protect us, you or others, from harm or in legal proceedings, protect our rights, protect our security and the security of others and property, respond to court orders, lawsuits, subpoenas and government requests, address legal and regulatory compliance, enforceour agreements and the Terms, notify you of safety issues, and collect amounts owed tous, when we believe this is necessary or appropriate to prevent financial loss or in connection with an investigation or prosecution of suspected, potential or actual prohibited, dangerous orillegal activity, or if we, in good faith, believe this is otherwise necessary or advisable.

k. Anonymized Information. For collecting, compiling and/or creating anonymized information, which we or a service provider, third party and/or other party can do, subject to applicable law, and which we or a service provider, third party and/or other party can use for any purpose, subject to applicable law.

l. With Your Consent. We can use your information other than as described in this Privacy Policy if we notify you and you consent to such use, subject to applicable law.

m. At Your Request. We can use your information at your request, subject to applicable law.

n. For Any Other Purpose with Notice by Us. We can use your information for any other purpose for which we provide you with notice, subject to applicable law.

o. Technologies; Do Not Track. Please see Technologies; Do Not Track above.

Please see Information Collection and Technologies; Do Not Track above and Disclosing or Sharing Information, Children’s Privacy, Storage, Retention and Choices Regarding Your Information below.

5. DISCLOSING OR SHARING INFORMATION

Information can be disclosed to or shared with other users and service providers, third parties and/or other parties in accordance with this Privacy Policy, subject to applicable law. Please note that a user can choose not to disclose or share certain information. Please see Information Collection, Technologies; Do Not Track and Information Use above and Children’s Privacy, Storage, Retention and Choices Regarding Your Information below.

a. Service Providers, Third Parties and/or Other Parties. We can use service providers, third parties and/or other parties for the provision of certain technology products and services and information on our behalf or in connection with a request by you, including without limitation, in connection with conducting the Anthem Pilot Study, in connection with transportation or meal delivery services, monitoring compliance by users with and enforcement of our agreements and the Terms, auditing interactions with you, detecting and preventing fraud, addressing information security, fixing errors, maintaining accounts, managing and storing your information, providing technical support, providing customer service and support, helping with our internal research and development, verifying product and service quality or safety, and performing any of the other actions or activities allowed under this Privacy Policy. We can disclose or share information about you with service providers, third parties and/or other parties that they need to perform their functions and in accordance with our agreements with them.In some cases, your information will be subject to the privacy policy and practices of the receiving service provider, third party and/or other party. These service providers, third parties and/or other parties are not controlled by us. We encourage you to read the privacy policies of each service provider, third party and/or other party with which you interact. We do not endorse, screen or approve, and are not responsible for the privacy practices of such service providers, third parties and/or other parties. Disclosing or sharing your information with these service providers, third parties and/or other parties is at your own risk.

b. Healthcare Providers. Subject to applicable law, we may disclose or share any information we collect with your healthcare providers, and/or other caregivers, for purposes of the Anthem Pilot Study. In some cases, your information will be subject to the privacy policy and practices of the receiving healthcare provider. We are not responsible for the privacy practices of such healthcare providers.

c. Business Changes. If we are involved in, or engage in the preparatory steps leading to, a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, liquidation, dissolution, purchase or sale of assets, or transition of servicesto another party or other parties, or other transaction or if the ownership of all or substantially all of our business otherwise changes, then we can disclose or share or transfer your information to another party or other parties in connection therewith and it can be used subsequently by such party or parties.

d. To Analyze and Interpret Key Trends and Messages regarding the Anthem Pilot Study. To analyze and interpret key trends and messages regarding the Anthem Pilot Study.

e. For Analytics. For analytics, including to understand how you use the Service, to determine how you access the Service, to improve the Service, to measure engagement and satisfaction with the Member App and with any other Gaja Health product or service, for research and development and/or fixing errors, by Gaja Health ora service provider, third party and/or other party, subject to applicable law.

f. Legal and Safety. Other partiessuch as law enforcement, government entities, courts,or service providers, third parties or other parties as required or allowed by applicable law and/or for enforcement of our agreements and the Terms, such as for the legal and safety purposes described in Information Use above, or otherwise to help prevent harm or fraud to us, you or others.

g. Anonymized Information. We can disclose or share anonymized information relating to users of the Service with any service provider, third party and/or other party for any purpose, subject to applicable law.

h. With Your Consent. We can disclose or share your information other than as described in this Privacy Policy if we notify you and you consent to this disclosure or sharing, subject to applicable law.

i. At Your Request. We can disclose or share your information with any other individual or service provider, third party and/or other party at your request, subject to applicable law.

j. For Any Other Purpose with Notice by Us. We can disclose or share your information for any other purpose for which we provide you with notice, subject to applicable law.

k. Technologies; Do Not Track. Please see Technologies; Do Not Track above.

6. LINKS TO OTHER WEBSITES AND MOBILE APPLICATIONS

This Privacy Policy applies only to the Service. The Service may have links to other websites, mobile applications or content or material, to which this Privacy Policy does not apply. The links from the Service do not imply that we endorse or have reviewed these websites, mobile applications or content or material. The policies and procedures we describe here do not apply to these websites, mobile applications or content or material. We neither can control nor are responsible for the privacy practices or content or material of these websites, mobile applications or other content or material. We suggest reviewing the privacy policies of these websites, mobile applications or content or material.

7. CHILDREN'S PRIVACY

The Service is not directed to individuals under age eighteen (18), and we do not knowingly collect personal information from individuals under age eighteen (18). If you are under the age of eighteen (18), please do not access, use, or submit any personal information through the Service. If you have reason to believe that we may have accidentally received personal information from an individual under age eighteen (18), please email us immediately at help@gogajahealth.com. If we learn that we have collected any individual under age eighteen’s (18’s) personal information in violation of applicable law, we will promptly take steps to delete such information.

8. SECURITY

We take steps to ensure that your information is treated securely and in accordance with this Privacy Policy. Unfortunately, nothing can be guaranteed to be 100% secure, and we cannot ensure or warrant the security of any information you provide to us. To the fullest extent permitted by applicable law, we do not accept liability for unauthorized disclosure. By using the Service or providing information to us, you agree that we may communicate with you electronically regarding security, privacy, and administrative issues relating to your use of the Service. You should use caution whenever submitting information through the Service and take special care in deciding which information you provide us with.

9. STORAGE

Your personal information is stored on servers in various locations, including the United States. Your personal information may be disclosed in response to inquiries or requests from government authorities in the countries in which we operate. United States federal and state governments, courts, or law enforcement or regulatory agencies may be able to obtain disclosure of your information through laws applicable in the United States. By using the Service, you understand that your information can be transferred to countries outside of your country of residence, including the United States, which may have data protection rules that are different from those of your country.Please see Information Collection, Technologies; Do Not Track, Information Use, Disclosing or Sharing Information and Children’s Privacy above and Retention and Choices Regarding Your Information below.

10. RETENTION

Gaja Health will retain your personal information for as long as reasonably necessary for the purposes outlined in this Privacy Policy, while we have a legitimate business need to do so in connection with your online account, or as required by law (for example, for legal, tax, accounting or other purposes), whichever is the longer.

To determine the appropriate retention period for your personal information, we will consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we use your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements. In certain circumstances, we can anonymize your personal information, subject to applicable law.

Please see Information Collection, Technologies; Do Not Track, Information Use, Disclosing or Sharing Information, Children’s Privacy and Storage above and Choices Regarding Your Information below.

11. CHOICES REGARDING YOUR INFORMATION

You have choices regarding your information on the Service.

a. Changing Your Information. You can make changes to your information, including accessing, correcting or updating your information, through your online account or by emailing us at help@gogajahealth.com, subject to applicable legal restrictions. We may take reasonable steps to verify your identity before providing access to, correction of or update of your personal information.

b. Deleting Your Information. You can delete your information through your online account or by emailing us at help@gogajahealth.com, subject to applicable legal restrictions. We may take reasonable steps to verify your identity before providing deletion of your personal information. Please see Retention above.

c. Email Communications. You can make changes regarding receiving email communications from us through your online account or by emailing us at help@gogajahealth.com.

d. Push Notifications. You can at any time request opt out from further allowing us to send you push notifications by adjusting the permissions in your mobile device.

e. Withdrawing Consent. You can withdraw your consent to our use, disclosure or sharing of your information at any time by emailing us at help@gogajahealth.com.

f. Technologies; Do Not Track. Please see Technologies; Do Not Track above.

g. Please see Retention above.Please see Information Collection, Technologies; Do Not Track, Information Use, Disclosing or Sharing Information, Children’s Privacy, Storage and Retention above.

12. CONTACT INFORMATION If you have any questions about our privacy practices or this Privacy Policy, please contact us at:

By email: help@gogajahealth.com

By postal address: 1783 Terrace Drive, Belmont, CA 94002

13. REVISIONS TO THIS PRIVACY POLICY

We may revise this Privacy Policy at any time and from time to time in our sole discretion. Please review this Privacy Policy periodically, and especially before you provide any information. If there are any material changes to this Privacy Policy, we will notify you as required by applicable law. This Privacy Policy was made effective on the date indicated above.