Effective January 12th, 2022

The Preamble to CTG Privacy Policy

CLEAR TO GO! ™is an enterprise-based service platform comprised of web and mobile-based applications that interface with a CTG Client's enterprise solution engaged to manage the entry and safe usage of facilities. The CTG Platform allows a Client to present a series of questions deemed necessary to comply with federal, state, and local guidelines for the safer operation of the Client's facilities and workforce. The CTG Platform is not a stand-alone app or software program. Public users may not download the app or use it for their individual purposes. A user must be invited or authorized by a CTG Client before downloading any CTG application or using the CTG Platform.

PLAIN ENGLISH: CTG collects information on behalf of its Clients so that users can enter facilities or otherwise engage with such Clients requesting the Services. All user data and personal information remains encrypted and stored in a HIPAA compliant environment for use solely to provide the Services. CTG does not sell or transfer user data or personal information to any third party. CTG shall not advertise or market to users any third-party product or services. The data and personal information provided to CTG is ONLY used by CTG to provide the Services. You may request that CTG delete your data and personal information as provided in the Privacy Policy below.

The Clear to Go, Inc. Privacy Policy

This Privacy Policy describes the privacy practices of Clear to Go, Inc. and its affiliates (referred to collectively as "CTG," "us," "we" and "our") in relation to your use of our websites, web-based SMS applications, and the CLEAR TO GO! ™ mobile applications along with any other resources we use to perform the Services (collectively, the "CTG Platform"). CTG licenses the CTG Services to its customers ("Clients") that require automated security tools for screening and tracking its personnel and guests at its facilities to best manage occupancy and assist with federal, state, and local guidelines for safer operation of their facilities. The CTG Platform collects information from users seeking entry and/or use of its Client's facility based on screening questions developed by the Client's compliance team. The user (referred to herein as "user" or "you" meets the applicable Client's criteria, such user can obtain an electronic security badge used at the Client's facility which is licensed on the CTG Platform (collectively, the "Services").

This Privacy Policy does not apply to other websites and services that may from time-to-time display a link to a different privacy policy on our website relating to internal applications relating to performance or visitor counts. In the event that we expand the CTG Platform through the acquisition of another enterprise or platform, that enterprise, company, or platform may operate under its own privacy policy accessible via a link on its properties unless we integrate its privacy practices with ours, at which point a link to this Privacy Policy will be displayed on those related properties.

We provide our Services as a resource intended to assist and support the safety and security of our Clients' facilities by gathering and reporting user information to comply with the Client's specified security requirements in accordance with federal, state, and local guidelines. You can choose whether you want to use the Services. If you do choose to use the Services, you must agree to the CTG Platform Terms of Use which is an agreement between us and users of the Services via the CTG Platform. By agreeing to the CTG Platform Terms https://app.cleartogo.co/service/terms you confirm that you have read and understand this Privacy Policy which explains how we collect, disclose, transfer, secure, and use information about you in connection with the Services and the CTG Platform, as well as the rights and choices you have regarding such activities. If you do not want us to collect and use information about you as described in this Privacy Policy, then you should not use the Services. By using the Services, you acknowledge that we will store, use and otherwise process your information in the United States. Unless otherwise specified herein, or on the CTG Platform, CTG is only the "processor" or "service provider" of the personal information that we collect about you as described in this Privacy Policy.

CTG takes your privacy seriously. CTG will never sell the personal information or aggregated data that we collect from our users to third parties. We collect and process your information solely to perform the Services for which we have been engaged to perform by the Client.

Information Collected

Information about your use of the Services is collected as follows:

• Registration. In order to use the Services, you may be required to register or provide certain personal information such as your name, email address or perhaps some information regarding the purpose of your visit, any recent travel, and possible exposure to contagions or other pathogens. You may be required to update or supplement this information that you provided at registration when entering a Client's facility.
• Services Information. We collect and store information in accordance with this Privacy Policy for our Clients. We collect data regarding your use of the Services, such as your responses to the Client questionnaires and any particular content that you provide, which may include personal information such as a vaccine card, test results, or other documents requested by the Client. We also collect information about your device when you access the Services including IP address, browser information (including referring URL), cookie information (including the unique, user-resettable identification number associated with a mobile device). We use cookies and other tracking technologies, which may include pixels, tags, web beacons, among other devices to collect information about your use of the Services. For more information about our use of cookies and other tracking technologies in relation to your use of the CTG Platform, see our Cookies Policy. Please note that we only use this information to perform the Services which requires transferring such information to the Client for which the Services are intended.
• Information from Client Sources. We may obtain additional information about you from the Client to provide the Services. For example, we may use data from the Client to verify and update your registration information necessary to validate that you have been authorized by the Client to enter the facility or to otherwise personalize the Services for your use.
• Non-registered Users. You must have been invited to use the CTG Platform to access these Services fully as intended. However, you may be able to access certain limited aspects of the Services on our website. The information we collect includes the referring website, if applicable, the type of browser you use, the material viewed and the time and date that you accessed the Services. We do not sell or transfer such data to any third party except to the Client for which the Services are performed.
• Data Collected Relating to Students, Schools, and School Districts. You may supply data or personal information because you are required to do so by your educational institution or employer. The institution or employer requires this data and merely engaged CTG to gather such on such an organization's behalf. Students using the Services are responsible for complying with the requirements and qualifications for entry or such institution's compliance requirements as determined by their specific educational institution, school district, or employer. You are responsible for ensuring the accuracy and completeness of such information supplied via the CTG Platform used by your educational institution for facility entry, personnel management, and safety protocols. Authorized persons at Client may access and view personally identifiable information. We may retain the data supplied by such authorized persons for as long as required by the applicable Client educational institution, or as otherwise required by applicable law.
• Geofencing/Location Tracking. In addition to the information collection and sharing practices detailed in this Privacy Policy, the CTG Platform may employ common tracking technologies like browser cookies, "Local Shared Objects" (such as "Flash" cookies), analytical tools, device identifications, or other technologies. CTG also collects certain technical information about the devices used to access and use the CTG Platform, such as user-agent, time stamps, hardware type, language and time zone settings, IP address, and operating system type and version.

How Your Information May be Used

Information about you may be used for the following purposes:

• Provision of the Services. We may use the information collected about you to provide and improve the Services.
• User Profiles. We may associate information that we have collected about your use of the Services with your registration information and any other information we have about you from using the Services, as described in this Privacy Policy, thereby creating a profile of you that we may update from time to time ("User Profile"). We do not sell or transfer any of this information except to provide the Services.
• K-12 Students. CTG shall not make any individual data gathered from students using the Services publicly available. CTG will not use any behavioral information to provide targeted advertising to Student or any user. We will not collect, use, or share information for any purpose beyond the authorized educational or school purposes, or as authorized by the applicable educational institution. CTG, however, does not limit an educational institution's use of the data that it is authorized to access in connection with the engagement of Services on the CTG Platform. In the event of an acquisition by another entity or merger, CTG will not provide a student's personal information to a successor entity unless the entity expressly agrees to the "Student Privacy Pledge" as set forth by the Future of Privacy Forum and the Software and Information Industry Association.
• Communications. By registering as a user, or using the CTG Platform, you agree to the use of your registration information and other information collected about you as described in this Privacy Policy to communicate with you about the Services and provide other information that may be necessary to provide the Services to the applicable Client. These communications may be conveyed through a variety of channels, subject to applicable law.
• Verification Purposes. We may use your information in conjunction with information from third parties (generally the applicable Client) to recognize you as a registered user when you visit one of our Client's Facilities, and to verify your identity and/or any applicable license, professional credentials, or vaccine card for security and access purposes. We also may be required to provide the Client with proof of your identity in addition to the CTG Badge on your mobile device, and if you are unable to do so to our reasonable satisfaction, we reserve the right to deny you access to the Services. While we do take steps to verify that users identify as the applicable registered user, we can make no guarantee as to their actual identity, the validity of any professional credentials, or whether the licensure documentation is genuine.
• Account Management. We may use your information to administer your account, forward to the applicable Client to gain entry, respond to your inquiries, fulfill your requests, and send you administrative communications about the Services.
• Investigations. We may use your information to detect, investigate and defend against the fraudulent or unlawful activity, violations of the CTG Terms of Use and to otherwise establish, exercise, and defend our legal rights.

Sharing Your Information with Third Parties

CTG shall only use information gathered to perform the Services. Information about your use of the Services will only be shared as follows:

• Clients. We disclose information that you provide CTG to the specific Client that has engaged the CTG Platform to gather information for screening and tracking personnel, contractors, vendors, and guests of the Client so that they may manage facility occupancy, workforce safety, and compliance with federal, state, and local guidelines.
• Service Providers. We work with third-party service providers to help us deliver the Services and assist CTG in the operation of the CTG Platform, including in the areas of email management and deployment, storage of personal health information (PHI), analytics, and credential validation as requested by client, as well as data storage and security. We may provide these service providers with personal information about users of the Services, which is encrypted and stored on HIPAA compliant server, so that CTG can fulfill its responsibilities to our Clients. All service providers must agree to perform their obligations in accordance with these Privacy Policies.
• User Profiles. Subject to applicable law, CTG may provide user profile data to the Client in order to provide the Services. CTG will not use or transfer data for any other purpose.
• Consent. We may only disclose your personal information to a third party not otherwise addressed by this Privacy Policy only if we obtain your express prior consent to do so.
• Aggregated Information. We may provide aggregated information about users of our Services to third parties as we deem appropriate only to carry out the intent and purpose of the Services on CTG Platform. For example, CTG may tell a Client what percentage of registered users of the CTG Platform have presented with specific information or status at a particular facility or location. This data is provided in a non-identifiable format.
• Business Transfers and Affiliates. Provided that such affiliates and transferee agree to these privacy Policies, we may share your information within our group of companies (meaning our subsidiaries, our ultimate holding company, and its subsidiaries) for purposes consistent with this Privacy Policy, subject to applicable law. We may also transfer your information in connection with a corporate change in control resulting from, for example, a sale to, or a merger with, another entity, or in the event of a sale of assets or a bankruptcy, and we reserve the right to transfer your personal information to the new party in control or the party acquiring assets provided they agree that the terms in this Privacy Policy continue to control such information.
• Legal Requirements. We may release personal information when we believe such release (i) is required to comply with valid legal requirements such as a law, regulation, search warrant, subpoena, or court order, and to meet national security or law enforcement requirements; or (ii) is reasonable in response to a physical threat to you or others, to protect the property or defend or assert legal rights of us or others.

Security of Information

We have implemented appropriate technical and organizational security measures to protect the personal information that we have under our control as a "processor" or as the "service provider" from unauthorized access, use, disclosure, and accidental loss. When you enter personal information, we encrypt the transmission of that information or use SSL connections (Secure Socket Layer) technology. You are solely responsible for maintaining the security and confidentiality of your account username and password. Unfortunately, no method of transmission over the internet or method of electronic storage is completely secure. Therefore, while we strive to protect your personal information, we cannot guarantee its absolute security.

Choice and Control

• Account Information. You may update your account information at any time through the account management feature available on the CTG Platform. You may also contact Customer Support at support@cleartogo.co and request that your registration information be updated or deleted entirely.
• Cookies. Most browser software can be set to reject all cookies, including third-party cookies, however, if you choose to reject our cookies, your ability to access and use the Services may be limited. Refer to our Cookies Policy for additional information about opting out of cookies.
• Interest-Based Ads. CTG will not sell data or use the CTG Platform to advertise any third-party products or services to you.
• Email Communications. If you no longer wish to receive a particular type of email communication from us, you may unsubscribe by clicking the "unsubscribe" link located at the bottom of the email and following the instructions. Note that certain email communications that we send to Users are service-related and as long as you are a user of the CTG Platform, you may not unsubscribe from such emails.
• Push Notifications. We may send you push notifications from time-to-time to notify you of upcoming updates that we think may be relevant to you with respect to the Services. If you no longer wish to receive these types of notifications, you may turn them off at the device level.
• California Residents. If you are a California resident, California law may provide you with additional rights regarding our use of your personal information, including certain rights detailed in the California Consumer Privacy Act, Cal Civ Code 1798.100 et seq. ("CCPA"). For more information relevant to our users who are California residents, please contact CTG customer service at support@cleartogo.co and request a copy of our Privacy Pledge.

Note to Users Outside of the United States

CTG and its supporting third-party providers are located in the United States, as is a majority of the CTG Platform's technical infrastructure including its data hosting facilities. For users outside the United States, in order to provide the Services to you, we likely will transfer your personal information outside of your country of residence to the United States where it will be stored and processed in accordance with this Privacy Policy. Further, for non-U.S. users, we may transfer your information outside the United States to service providers with operations in other countries. By using the Services, you consent to such collection, storage, and processing in the United States and elsewhere, though the United States and other jurisdictions may not afford the same level of data protection as considered adequate in your own country. We will take reasonable steps to protect your personal information. Note that your personal information may be available to the United States government or its agencies under legal processes available in the United States.

Children's Privacy

The CTG Platform and the Services are designed and intended for use by users of all ages, some of which may be minors. Any usage by a minor may only be in connection with an approved Client, educational institution, or similar organization that has obtained all appropriate parental approvals or legal authority regarding the minors' use of the CTG Platform.

Privacy Policy Changes

We reserve the right to modify this Privacy Policy at any time and any changes will be effective upon posting of the modified Privacy Policy unless we advise otherwise. If we make any material changes to this Privacy Policy, we will notify you by email (sent to the email address of record in your account profile) and/or by means of a notice on our websites before the change becomes effective. We encourage you to periodically review this Privacy Policy for the latest information on our privacy practices. By continuing to use the Services after changes are made to this Privacy Policy, you agree to such changes.

Contacting Us

If you have general questions about your account or the Services, contact customer service at support@cleartogo.co. For questions about this Privacy Policy or how your personal information may be used when you use the Services, please contact our Privacy Officer by email at support@cleartogo.co. Please note that if you contact us to assist you, we may need to verify your identity before fulfilling your request.