Privacy Policy

September 13, 2023

Introduction

Sermonix Pharmaceuticals (“Company” or “We”) respect your privacy and are committed to protecting it through our compliance with this policy.

This policy describes the types of information we may collect from you or that you may provide when you visit a company website, such as www.discoverELAINE.com or www.discoverELAINE.com (a “Website”), along with any other digital platforms that we may provide from time to time, whether as a guest or a registered user (collectively, the “Services”), and our practices for collecting, using, maintaining, protecting, and disclosing that information.

This policy applies to information we collect:

• On the Website, the App, and any other platforms comprising our Services.
• In email, text, and other electronic messages between you and the Services.
• Through mobile and desktop applications you download from this Website or a third-party application provider or store, including the App, which provide interaction between you and Company.
• It does not apply to information collected by:
• Us offline or through any other means, including on any other website operated by any third party; or
• Any third party, including through any application or content (including advertising) that may link to or be accessible from or on the Services.

Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Services. By accessing or using the Services, you agree to this privacy policy. This policy may change from time to time (see Changes to Our Privacy Policy). Your continued use of the Services after we make changes is deemed to be acceptance of those changes, so please check the policy periodically for updates.

Children Under the Age of 18

Our Services are not intended for children under 18 years of age. No one under age 18 may provide any information to or on the Services. We do not knowingly collect personal information from children under 18. If you are under 18, do not use or provide any information on the Services or on or through any of its features. If we learn we have collected or received personal information from a child under 18 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 18, please contact us at:

250 E. Broad Street, Suite 250

Columbus, OH 43215

info@sermonixpharma.com

Information We Collect About You and How We Collect It

We collect several types of information from and about users of our Services, including information:

• By which you may be personally identified, such as name, postal address, e-mail address, telephone number, or any other identifier by which you may be contacted online or offline (“personal information”);
• That is about you but individually does not identify you; and/or
• About your internet connection, the equipment you use to access our Services, and usage details.
• We collect this information:
• Directly from you when you provide it to us.
• Automatically as you navigate through the Services. Information collected automatically may include device information, operating system, browser type, usage details, IP addresses, metadata stored on your device, and information collected through cookies, and other analytics technologies.

Information You Provide to Us

The information we collect on or through our Services may include:

• Information that you provide by filling in forms on our Services. This includes information provided at the time of registering to use our Services, subscribing to our service, or requesting further services. For instance, we may ask you to create an account that would include provision of your name and email address, or we may ask you to fill out a form that asks questions about your medical symptoms or quality of life (“Patient Reported Outcomes,” or “PRO”). We may also ask you for information when you report a problem with our Services. You may delete or deactivate your account at any time, but please note that 1) deletion and deactivation will prevent us from providing any of our services to you, and 2) we may continue to store, use and disclose your personal information and PHI (defined below) in compliance with this privacy policy and applicable federal and state laws and regulations.
• Records and copies of your correspondence (including email addresses), if you contact us.
• Your responses to surveys that we might ask you to complete for market or product research purposes. Should we wish to conduct medical research via the Services, we will ask you for your consent prior to participation in any such research.
• Your search queries on the Services.
• Via our mobile application, personal information or PHI (defined below) collected from your participation in clinical trials or medical services that we administer or provide.

Medical Information

Protected health information (“PHI”) is information about you that may be used to identify you (such as your name, social security number, or address), and that relates to (a) your past, present, or future physical or mental health or condition, (b) the provision of healthcare to you, or (c) your past, present, or future payment for the provision of health care. In providing our services, we will receive and create records containing your PHI, and may use it to assist you in administering our clinical trials or treatments, develop and conduct surveys with you to assist in providing you better services, conduct our management and administrative activities, and otherwise, as stated in this Privacy Policy.

We may also use your de-identified PHI to help us learn from your experience and contribute to research. We are committed to ensuring the quality and effectiveness of our services and our Services (including our mobile application), and therefore periodically evaluate the outcomes and experiences of our users. Any information you provide, usage data, or answers you submit to questions in this program may be grouped with information from other users and analyzed in a fully de-identified manner (without your name or other identifying information) to assess the quality of our Services (including our App). This anonymous aggregate information may also be used in scientific research publications and presentations. We are required by law to maintain the privacy and confidentiality of your PHI, and we operate the Services (including our App) in compliance with applicable federal and state laws governing health information privacy and security. All medical or health information that we collect is in compliance with HIPAA. All of our systems and platforms are HIPAA-compliant, meaning that we take steps such as encryption of all stored personal information and data transmissions and two-factor authentication of any human-readable data with internal access provided only to appropriate administrators.

We do not link personal information that is collected outside of the context of our mobile application with any PHI.

Information We Collect Through Automatic Data Collection Technologies

As you navigate through and interact with our Services, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

• Details of your visits to our Services, including traffic data, location data, logs, and other communication data and the resources that you access and use on the Services.
• Information about your computer and internet connection, including your IP address, operating system, and browser type.

The information we collect automatically may include personal information. It helps us to improve our Services and to deliver a better and more personalized service, including by enabling us to:

• Estimate our audience size and usage patterns.
• Store information about your preferences, allowing us to customize our Services according to your individual interests.
• Speed up your searches.
• Recognize you when you return to our Services.

The technologies we use for this automatic data collection may include:

Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting, you may be unable to access certain parts of our Services. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our Services.

Flash Cookies. Certain features of our Services may use local stored objects (or Flash cookies) to collect and store information about your preferences and navigation to, from, and on our Services. Flash cookies are not managed by the same browser settings as are used for browser cookies. For information about managing your privacy and security settings for Flash cookies, see Choices About How We Use and Disclose Your Information.

Web Beacons. Pages of our Services may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).

Third-Party Use of Cookies and Other Tracking Technologies

Some content or applications on the Services are served by third parties, including analytics platforms like Hotjar and application providers. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use our Services. The information they collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites and other online services. We do not control these third parties’ tracking technologies or how they may be used.

However, we provide third party vendors only with anonymized or aggregated data, and our third-party vendors use this anonymized or aggregated data collected from the Services only for purposes related to the operation of the Services.

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal information:

• To present our Services and its contents to you.
• To provide you with information, products, or services that you request from us.
• To contact you regarding your use of our Services.
• To fulfill any other purpose for which you provide it.
• To provide you with notices about your account, including expiration and renewal notices.
• To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
• To notify you about changes to our Services or any products or services we offer or provide through it.
• To allow you to participate in interactive features on our Services.
• To provide and administer clinical trials or medical services.
• In any other way we may describe when you provide the information.
• For any other purpose with your consent.

We may also use your information to contact you about goods and services that we offer that may be of interest to you. If you do not want us to use your information in this way, please do not use the Services or our services. We do not offer third party goods and services via the Services. For more information, see Choices About How We Use and Disclose Your Information.

We do not offer a means to store any personal information that is not collected via our Services themselves, including the App.

Please see the Medical Information section for information about how we collect, use, and store PHI.

Disclosure of Your Information

We may disclose aggregated information about our users without restriction.

We may disclose personal information that we collect or you provide as described in this privacy policy:

• To contractors, service providers, and other third parties we use to support our business and who are bound by contractual obligations to keep personal information confidential and use it only for the purposes for which we disclose it to them.
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Sermonix Pharmaceuticals’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Sermonix Pharmaceuticals, about our Services’ users is among the assets transferred.
• To fulfill the purpose for which you provide it.
• For any other purpose disclosed by us when you provide the information.
• With your explicit consent, including your consent to disclose your personal information (which may include PHI) to your healthcare provider.
• We may also disclose your personal information:
• To comply with any court order, law, or legal process, including to respond to any government or regulatory request, or disclosures to the federal government. For instance, we may be required to report a Serious Adverse Event to the FDA, as defined by FDA regulations, which may include the disclosure of personal information.
• To comply with and other agreements, including for billing and collection purposes.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Sermonix Pharmaceuticals, our customers, or others.

Choices About How We Use and Disclose Your Information

We strive to provide you with choices regarding the personal information you provide to us. We have created mechanisms to provide you with the following control over your information:

• Tracking Technologies and Advertising. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of this site may then be inaccessible or not function properly.

We do not control third parties’ collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can opt out of receiving targeted ads from members of the Network Advertising Initiative (“NAI”) on the NAI’s website, optout.networkadvertising.org

Data Security

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. We have implemented data security features in compliance with HIPAA. Users should not share HIPAA-protected patient information, including PHI, on any public-facing components or features of the Services. We are not responsible for any breaches of HIPAA requirements or unauthorized disclosure of PHI by you or any third parties on our Website or App. For more information with regard to PHI, please see the “Medical Information” section, above.

The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to our Services. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Services.

Changes to Our Privacy Policy

It is our policy to post any changes we make to our Privacy Policy on this webpage, or via updated documents that we may distribute from time to time to relevant users. If we make material changes to how we treat our users’ personal information, we will notify you by email to the primary email address specified in your account. The date the privacy policy was last revised is identified at the top of the Privacy Policy. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our Services and this privacy policy to check for any changes.

Your California Privacy Rights

If you are a California resident, California law may provide you with additional rights regarding our use of your personal information.

The Company is currently exempt from the provisions of the California Consumer Privacy Act (“CCPA”). Further, the CCPA does not apply to any PHI we collect; this Your California Privacy Rights does not create any additional rights or privileges for you as it relates to PHI.

We currently do not sell any of your personal information or PHI to third parties.

California’s Online Privacy Protection Act (Cal. Bus. & Prof. C. §§22575-22579) (“CalOPPA”), requires website operators to disclose how they respond to web browser “do not track” signals or other similar mechanisms that provide consumers with the ability to exercise choice regarding the collection of personally identifiable information of a consumer over time and across third party websites and apps, to the extent the operator engages in that collection. At this time, we do not respond to Do Not Track (DNT) signals. This law also requires website and app operators to disclose whether third parties may collect personally identifiable information about their users’ online activities over time and across different websites and apps when the users use the operator’s website or app. The nature of how third parties may collect or receive personally identifiable information is disclosed in this Privacy Policy. To learn more about how Do Not Track signals work, please visit allaboutdnt.com.

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our Services that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. We do not currently disclose personal information to third parties for their direct marketing purposes. However, to make such a request, please send an email to info@metamehealth.com. Please allow us 30 days for a response.

Contact Information

To ask questions or comment about this privacy policy, contact us at:

250 E. Broad Street, Suite 250

Columbus, OH 43215

info@sermonixpharma.com