Effective May 1, 2023

The Preamble to PrevailHQ ™ (PHQ) Privacy Policy

PrevailHQ ™is an enterprise-based software as a service (SaaS) platform comprised of modules that are both web and mobile-based applications that interface with a PHQ client's enterprise solution engaged to manage worforce disruptions.

The PHQ Platform allows a Client to present a series of questions deemed necessary to comply with federal, state, and local guidelines for the safer operation of the Client's facilities and workforce. The PHQ Platform is not a stand-alone app or software program. Public users may not download the app or use it for their individual purposes. A user must be invited or authorized by a PHQ Client before downloading any PHQ application or using the PHQ Platform.

PLAIN ENGLISH: PHQ collects information on behalf of its Clients so that users can enter facilities or otherwise engage with such Clients requesting the Services. All user data and personal information remains encrypted and stored in a HIPAA compliant environment for use solely to provide the Services. PHQ does not sell or transfer user data or personal information to any third party. PHQ shall not advertise or market to users any third-party products or services. The data and personal information provided to PHQ is ONLY used by PHQ to provide the Services. You may request that PHQ delete your data and personal information as provided in the Privacy Policy below or applicable law.

The PrevailHQ, Inc. Privacy Policy

This Privacy Policy describes the privacy practices of PrevailHQ, Inc. and its affiliates (referred to collectively as "PHQ," "us," "we" and "our") in relation to your use of our websites, web-based SMS applications, and the PrevailHQ ™ mobile applications along with any other resources we use to perform the Services (collectively, the "PHQ Platform"). PHQ licenses the PHQ Services to its customers ("Clients") that require automated security tools for screening and tracking its personnel and guests at its facilities to best manage occupancy and assist with federal, state, and local guidelines for safer operation of their facilities. The PHQ Platform collects information from users seeking entry and/or use of its Client's facility based on screening questions developed by the Client's compliance team. The user (referred to herein as "user" or "you" meets the applicable Client's criteria, such user can obtain an electronic security badge used at the Client's facility which is licensed on the PHQ Platform (collectively, the "Services").

This Privacy Policy does not apply to other websites and services that may from time-to-time display a link to a different privacy policy on our website relating to internal applications relating to performance or visitor counts. In the event that we expand the PHQ Platform through the acquisition of another enterprise or platform, that enterprise, company, or platform may operate under its own privacy policy accessible via a link on its properties unless we integrate its privacy practices with ours, at which point a link to this Privacy Policy will be displayed on those related properties.

We provide our Services as a resource intended to assist and support the safety and security of our Clients' facilities by gathering and reporting user information to comply with the Client's specified security requirements in accordance with federal, state, and local guidelines. You can choose whether you want to use the Services. If you do choose to use the Services, you must agree to the PHQ Platform Terms of Use which is an agreement between us and users of the Services via the PHQ Platform. By agreeing to the PHQ Platform Terms https://app.prevailhq.com/service/terms you confirm that you have read and understand this Privacy Policy which explains how we collect, disclose, transfer, secure, and use information about you in connection with the Services and the PHQ Platform, as well as the rights and choices you have regarding such activities. If you do not want us to collect and use information about you as described in this Privacy Policy, then you should not use the Services. By using the Services, you acknowledge that we will store, use and otherwise process your information in the United States. Unless otherwise specified herein, or on the PHQ Platform, PHQ is only the "processor" or "service provider" of the personal information that we collect about you as described in this Privacy Policy.

PHQ takes your privacy seriously. PHQ will never sell the personal information or aggregated data that we collect from our users to third parties. We collect and process your information solely to perform the Services for which we have been engaged to perform by the Client.

Information Collected

Information about your use of the Services is collected as follows:

• Registration. In order to use the Services, you may be required to register or provide certain personal information such as your name, email address or perhaps some information regarding the purpose of your visit, any recent travel, and possible exposure to contagions or other pathogens. You may be required to update or supplement this information that you provided at registration when entering a Client's facility.
• Services Information. We collect and store information in accordance with this Privacy Policy for our Clients. We collect data regarding your use of the Services, such as your responses to the Client questionnaires and any particular content that you provide, which may include personal information such as a vaccine card, test results, or other documents requested by the Client. We also collect information about your device when you access the Services including IP address, browser information (including referring URL), cookie information (including the unique, user-resettable identification number associated with a mobile device). We use cookies and other tracking technologies, which may include pixels, tags, web beacons, among other devices to collect information about your use of the Services. For more information about our use of cookies and other tracking technologies in relation to your use of the PHQ Platform, see our Cookies Policy. Please note that we only use this information to perform the Services which requires transferring such information to the Client for which the Services are intended.
• Information from Client Sources. We may obtain additional information about you from the Client to provide the Services. For example, we may use data from the Client to verify and update your registration information necessary to validate that you have been authorized by the Client to enter the facility or to otherwise personalize the Services for your use.
• Non-registered Users. You must have been invited to use the PHQ Platform to access these Services fully as intended. However, you may be able to access certain limited aspects of the Services on our website. The information we collect includes the referring website, if applicable, the type of browser you use, the material viewed and the time and date that you accessed the Services. We do not sell or transfer such data to any third party except to the Client for which the Services are performed.
• Data Collected Relating to Students, Schools, and School Districts. You may supply data or personal information because you are required to do so by your educational institution or employer. The institution or employer requires this data and merely engaged PHQ to gather such on such an organization's behalf. Students using the Services are responsible for complying with the requirements and qualifications for entry or such institution's compliance requirements as determined by their specific educational institution, school district, or employer. You are responsible for ensuring the accuracy and completeness of such information supplied via the PHQ Platform used by your educational institution for facility entry, personnel management, and safety protocols. Authorized persons at Client may access and view personally identifiable information. We may retain the data supplied by such authorized persons for as long as required by the applicable Client educational institution, or as otherwise required by applicable law.
• Geofencing/Location Tracking. In addition to the information collection and sharing practices detailed in this Privacy Policy, the PHQ Platform may allow employers or organizations to enable common tracking technologies like browser cookies, "Local Shared Objects" (such as "Flash" cookies), analytical tools, device identifications, or other technologies. PHQ also collects certain technical information about the devices used to access and use the PHQ Platform, such as user-agent, time stamps, hardware type, language and time zone settings, IP address, and operating system type and version.

How Your Information May be Used

Information about you may be used for the following purposes:

• Provision of the Services. We may use the information collected about you to provide and improve the Services.
• User Profiles. We may associate information that we have collected about your use of the Services with your registration information and any other information we have about you from using the Services, as described in this Privacy Policy, thereby creating a profile of you that we may update from time to time ("User Profile"). We do not sell or transfer any of this information except to provide the Services.
• K-12 Students. PHQ shall not make any individual data gathered from students using the Services publicly available. PHQ will not use any behavioral information to provide targeted advertising to Student or any user. We will not collect, use, or share information for any purpose beyond the authorized educational or school purposes, or as authorized by the applicable educational institution. PHQ, however, does not limit an educational institution's use of the data that it is authorized to access in connection with the engagement of Services on the PHQ Platform. In the event of an acquisition by another entity or merger, PHQ will not provide a student's personal information to a successor entity unless the entity expressly agrees to the "Student Privacy Pledge" as set forth by the Future of Privacy Forum and the Software and Information Industry Association.
• Communications. By registering as a user, or using the PHQ Platform, you agree to the use of your registration information and other information collected about you as described in this Privacy Policy to communicate with you about the Services and provide other information that may be necessary to provide the Services to the applicable Client. These communications may be conveyed through a variety of channels, subject to applicable law.
• Verification Purposes. We may use your information in conjunction with information from third parties (generally the applicable Client) to recognize you as a registered user when you visit one of our Client's Facilities, and to verify your identity and/or any applicable license, professional credentials, or vaccine card for security and access purposes. We also may be required to provide the Client with proof of your identity in addition to the PHQ Badge on your mobile device, and if you are unable to do so to our reasonable satisfaction, we reserve the right to deny you access to the Services. While we do take steps to verify that users identify as the applicable registered user, we can make no guarantee as to their actual identity, the validity of any professional credentials, or whether the licensure documentation is genuine.
• Account Management. We may use your information to administer your account, forward to the applicable Client to gain entry, respond to your inquiries, fulfill your requests, and send you administrative communications about the Services.
• Investigations. We may use your information to detect, investigate and defend against the fraudulent or unlawful activity, violations of the PHQ Terms of Use and to otherwise establish, exercise, and defend our legal rights.

Sharing Your Information with Third Parties

PHQ shall only use information gathered to perform the Services. Information about your use of the Services will only be shared as follows:

• Clients. We disclose information that you provide PHQ to the specific Client that has engaged the PHQ Platform to gather information for screening and tracking personnel, contractors, vendors, and guests of the Client so that they may manage facility occupancy, workforce safety, and compliance with federal, state, and local guidelines.
• Service Providers. We work with third-party service providers to help us deliver the Services and assist PHQ in the operation of the PHQ Platform, including in the areas of email management and deployment, storage of personal health information (PHI), analytics, and credential validation as requested by Client, as well as data storage and security. We may provide these service providers with personal information about users of the Services, which is encrypted and stored on HIPAA compliant server, so that PHQ can fulfill its responsibilities to our Clients. All service providers must agree to perform their obligations in accordance with these Privacy Policies.
• User Profiles. Subject to applicable law, PHQ may provide user profile data to the Client in order to provide the Services. PHQ will not use or transfer data for any other purpose.
• Consent. We may only disclose your personal information to a third party not otherwise addressed by this Privacy Policy only if we obtain your express prior consent to do so.
• Aggregated Information. We may provide aggregated information about users of our Services to third parties as we deem appropriate only to carry out the intent and purpose of the Services on the PHQ Platform. For example, PHQ may tell a Client what percentage of registered users of the PHQ Platform have presented with specific information or status at a particular facility or location. This data is provided in a non-identifiable format.
• Business Transfers and Affiliates. Provided that such affiliates and transferee agree to these privacy Policies, we may share your information within our group of companies (meaning our subsidiaries, our ultimate holding company, and its subsidiaries) for purposes consistent with this Privacy Policy, subject to applicable law. We may also transfer your information in connection with a corporate change in control resulting from, for example, a sale to, or a merger with, another entity, or in the event of a sale of assets or a bankruptcy, and we reserve the right to transfer your personal information to the new party in control or the party acquiring assets provided they agree that the terms in this Privacy Policy continue to control such information.
• Legal Requirements. We may release personal information when we believe such release (i) is required to comply with valid legal requirements such as a law, regulation, search warrant, subpoena, or court order, and to meet national security or law enforcement requirements; or (ii) is reasonable in response to a physical threat to you or others, to protect the property or defend or assert legal rights of us or others.

Security of Information

We have implemented appropriate technical and organizational security measures to protect the personal information that we have under our control as a "processor" or as the "service provider" from unauthorized access, use, disclosure, and accidental loss. When you enter personal information, we encrypt the transmission of that information or use SSL connections (Secure Socket Layer) technology. You are solely responsible for maintaining the security and confidentiality of your account username and password. Unfortunately, no method of transmission over the internet or method of electronic storage is completely secure. Therefore, while we strive to protect your personal information, we cannot guarantee its absolute security.

Choice and Control

• Account Information. You may update your account information at any time through the account management feature available on the PHQ Platform. You may also contact Customer Support at support@prevailhq.com and request that your registration information be updated or deleted entirely.
• Cookies. Most browser software can be set to reject all cookies, including third-party cookies, however, if you choose to reject our cookies, your ability to access and use the Services may be limited. Refer to our Cookies Policy for additional information about opting out of cookies.
• Interest-Based Ads. PHQ will not sell data or use the PHQ Platform to advertise any third-party products or services to you.
• Email Communications. If you no longer wish to receive a particular type of email communication from us, you may unsubscribe by clicking the "unsubscribe" link located at the bottom of the email and following the instructions. Note that certain email communications that we send to Users are service-related and as long as you are a user of the PHQ Platform, you may not unsubscribe from such emails.
• Push Notifications. We may send you push notifications from time to time to notify you of upcoming updates that we think may be relevant to you with respect to the Services. If you no longer wish to receive these types of notifications, you may turn them off at the device level.
• California Residents. If you are a California resident, California law may provide you with additional rights regarding our use of your personal information, including certain rights detailed in the California Consumer Privacy Act, Cal Civ Code 1798.100 et seq. ("CCPA"). For more information relevant to our users who are California residents, please contact PHQ customer service at support@prevailhq.com and request a copy of our Privacy Pledge.

Note to Users Outside of the United States

PHQ and its supporting third-party providers are located in the United States, as is a majority of the PHQ Platform's technical infrastructure including its data hosting facilities. For users outside the United States, in order to provide the Services to you, we likely will transfer your personal information outside of your country of residence to the United States where it will be stored and processed in accordance with this Privacy Policy. Further, for non-U.S. users, we may transfer your information outside the United States to service providers with operations in other countries. By using the Services, you consent to such collection, storage, and processing in the United States and elsewhere, though the United States and other jurisdictions may not afford the same level of data protection as considered adequate in your own country. We will take reasonable steps to protect your personal information. Note that your personal information may be available to the United States government or its agencies under legal processes available in the United States.

Children's Privacy

The PHQ Platform and the Services are designed and intended for use by users of all ages, some of which may be minors. Any usage by a minor may only be in connection with an approved Client, educational institution, or similar organization that has obtained all appropriate parental approvals or legal authority regarding the applicable minor's use of the PHQ Platform.

Privacy Policy Changes

We reserve the right to modify this Privacy Policy at any time and any changes will be effective upon posting of the modified Privacy Policy unless we advise otherwise. If we make any material changes to this Privacy Policy, we will notify you by email (sent to the email address of record in your account profile) and/or by means of a notice on our websites before the change becomes effective. We encourage you to periodically review this Privacy Policy for the latest information on our privacy practices. By continuing to use the Services after changes are made to this Privacy Policy, you agree to such changes.

Contacting Us

If you have general questions about your account or the Services, contact customer service at support@prevailhq.com. For questions about this Privacy Policy or how your personal information may be used when you use the Services, please contact our Privacy Officer by email at support@prevailhq.com. Please note that if you contact us to assist you, we may need to verify your identity before fulfilling your request.