Effective Date: 05/19/2026

Privacy Policy And Authorization

IMPORTANT – THIS PRIVACY POLICY AND AUTHORIZATION AGREEMENT IS A LEGAL AGREEMENT BETWEEN YOU AND RIGHTDEVICE, INC. DBA PATIENTPARTNER. YOU SHOULD READ CAREFULLY THE FOLLOWING PRIVACY POLICY AND AUTHORIZATION BECAUSE IT GOVERNS YOUR PARTICIPATION IN THE SERVICE AND THE PATIENTPARTNER MENTOR PROGRAM OFFERED BY RIGHTDEVICE. RIGHTDEVICE IS WILLING TO GRANT YOU THE RIGHT TO UTILIZE THE SERVICE AND PARTICIPATE IN THE PATIENTPARTNER MENTOR PROGRAM ONLY ON THE CONDITION THAT YOU AGREE TO ALL OF THE TERMS AND CONDITIONS SET FORTH IN THIS AGREEMENT. IF YOU DO NOT AGREE WITH ALL OF THE TERMS AND CONDITIONS SET FORTH IN THIS AGREEMENT, YOU ARE NOT GRANTED PERMISSION TO UTILIZE THE SERVICE NOR PARTICIPATE IN THE PATIENTPARTNER™ MENTOR PROGRAM. BY ACCESSING OR USING THE SERVICE, OR BY CLICKING "SUBMIT" OR A SIMILAR ACKNOWLEDGMENT WHEN CREATING AN ACCOUNT OR ENROLLING IN THE SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ THIS AGREEMENT, THAT YOU UNDERSTAND IT AND ITS TERMS AND CONDITIONS, AND THAT YOU AGREE TO BE BOUND LEGALLY BY IT AND ITS TERMS AND CONDITIONS.

Rightdevice, Inc. dba PatientPartner ("Rightdevice", "us", "we", or "our") operates the https://www.patientpartner.com website. This Privacy Policy and Authorization Agreement ("Agreement" or "Privacy Policy") informs you ("you", "your", or "user") of our policies regarding the collection, use, and disclosure of Personal Data when you use our Service and the choices you have associated with that data.

We use your Personal Data to provide and improve the Service. By using the Service, you agree to the collection and use of information in accordance with this Agreement. Unless otherwise defined in this Agreement, the terms used in this Agreement have the same meanings as in our Terms of Service, accessible from https://patientpartner.com/terms

Rightdevice uses reasonable administrative, physical, and electronic security measures to protect against the loss, misuse, and alteration of your Personal Data. However, the internet cannot be guaranteed to be entirely secure, and your transmission of data over it is at your own risk. Neither Rightdevice nor our Service Providers can ensure or warrant the security of the information you send us over the internet. You should protect your data by carefully selecting and protecting your password. Limit access to your computer or device and browser.

Definitions

1. Service
2. Service ("Service") means the website located at https://www.patientpartner.com, the PatientPartner MentorConnect Program, any related mobile or web applications, and all related features, tools, content, and services made available by Rightdevice. The PatientPartner MentorConnect Program is a peer support platform designed to assist you through your healthcare journey, including but not limited to: connecting you with a network of trained peer mentors, including patients and caregivers who have undergone similar treatments or experiences, to provide one-on-one support, guidance, and encouragement; facilitating educational conversations and information sharing related to your condition, treatment options, or care experience; and providing access to curated educational resources, tools, and content relevant to your healthcare journey. The Service is intended to supplement, not replace, the advice and care of qualified healthcare professionals.
3. Personal Data
4. Personal Data ("Personal Data"), otherwise known as individually identifiable information, means data about an individual who can be identified from the supplied data (or from those and other information either in our possession or likely to come into our possession). Rightdevice may de-identify Personal Data. Once identifying information is removed, Rightdevice no longer treats the data as Personal Data. Rightdevice may aggregate or statistically analyze Personal Data from more than one user, in which case such resulting aggregated or statistically analyzed data will not be treated as Personal Data by Rightdevice.
5. Usage Data
6. Usage Data ("Usage Data") is data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit). See the later section for additional relevant provisions concerning Usage Data.
7. Cookies
8. Cookies ("Cookies") are small files stored on your device (computer or mobile device).
9. Service Providers
10. Service Providers ("Service Providers") means third-party companies, vendors, or individuals that we engage to help facilitate, provide, or improve the Service on our behalf.
11. Partners
12. Partners ("Partners") refers to Rightdevice customers, clients, or affiliates that engage our Service, as well as third parties authorized to act on the Partners' behalf.

Information Collection and Use

We collect several different types of information for various purposes to provide and improve our Service to you, as well as to facilitate your use of our Service.

Types of Data Collected

1. Personal DataWhile using our Service, we may ask you to provide us with certain Personal Data that can be used to contact or identify you. Personal Data may include, but is not limited to:
   1. User-ID by the Service
   2. First name and last name
   3. Email address
   4. Phone number
   5. Address, state, province, zip/postal code, city
   6. IP addresses
   7. Geolocation data
   8. Date of birth
   9. Current/Historical treatments: procedures, medications, treatments, surgeries, etc.
   10. Established/Historical healthcare professional
   11. Height and weight
   12. Current/Historical health conditions: diagnosis, comorbidities, diseases, conditions, etc.
   13. Health insurance information
   14. And other relevant healthcare-related information
   15. Cookies and usage data
   16. Private message content for Private messages between users and mentors (kept and reviewed internally for quality assurance and safety)
2. Non-Identifying DataNon-Identifying Data ("Non-Identifying Data") is all information, except Personal Data, that users provide about themselves when using the Service or in other communications with Rightdevice. Examples of Non-Identifying Data that users may submit include:
   1. Non-identifying photographs
   2. Age (unless over 89)
   3. Location (city, state/province, country)
   4. Sex
   5. Gender identity
   6. Condition/Disease information (e.g., first symptom, family history)
   7. Treatment information (e.g., treatment stop reasons, dosages, side effects, treatment evaluations)
   8. Symptom information (e.g., severity, duration)
   9. Outcome scores (e.g., ALSFRS-R, MSRS, PDRS, FVC, PFRS, DailyMe, and MonthlyMe measures (not including free-text associated with this tracking))
   10. Health measures (e.g., weight, blood pressure, sleep, activity)
   11. Laboratory results and biomarkers (e.g., CD4 count, viral load, creatinine, images)
   12. Structured survey responses
   13. Free text entries, including: direct messages, conversation messages, forum posts, comments, treatment evaluations, surveys, annotations, journals, and feeds (collectively, "Free Text Entries"), that you make anywhere on the Service some of which is by default available to view by the public, including unregistered users (Please Note: If you include information that would otherwise be considered "Personal Data" within any Free Text Entries, for purposes of this Policy, such information will be treated as "Non-Identifying Data")
   Rightdevice may aggregate or statistically analyze data, including from more than one user. The resulting aggregated or statistically analyzed data shall be treated as Non-Identifying Data by Rightdevice.
3. Usage DataWe may also collect information on how the Service is accessed and used. We and our Service Providers, use (or may use) analytics code and may use web tracking technologies such as cookies, pixel tags, embedded scripts, web-beacons (also known as tracking pixels) and other tracking technologies to understand how users use our Service and to improve products and services. Such Usage Data can include the URL of the websites you visited before and after you visited our Service, the type of browser you are using, your internet service provider, your computer's internet protocol address (e.g. IP address), browser type, browser version, what pages on our platform you visit, what links you click on, date and time of your visit and duration, whether you open email communications we send to you, and whether you interact with advertising or content displayed on the site and third-party sites. The analytics code also collects information about you, such as geolocation, age, gender, affinity categories, and interests, which can be used by Rightdevice. You may be able to modify your browser settings to alter which web tracking technologies are permitted when you use the Service, but this may limit your use of the Service. Usage Data is typically only used by Rightdevice and our Service Providers. However, when de-identified, Usage Data may also be shared with our Partners to help them understand how members use and benefit from the Service.You can instruct your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if you do not accept Cookies, you may not be able to use some portions of our Service.Examples of Cookies we use:
   1. Session Cookies. We use Session Cookies to operate our Service.
   2. Preference Cookies. We use Preference Cookies to remember your preferences and various settings.
   3. Security Cookies. We use Security Cookies for security purposes.

Use of Data

Rightdevice uses the collected Personal Data for various purposes and to the extent required to complete the activities listed below:

1. To provide and maintain the Service
2. For research
3. To create better tools and more personalized experiences for you.
4. To notify you about changes to our Service
5. To allow you to participate in interactive features of our Service when you choose to do so
6. To inform you of the features of our Service
7. To inform or provide you with relevant data and information regarding our Partners and their products and services
8. To monitor the usage of the Service
9. To provide analysis or valuable information so that we can improve the Service and our Partners can improve their products and services
10. To detect, prevent, and address technical issues.

Rightdevice may report individual adverse events and product safety information to regulatory agencies like the FDA, CDC or other bodies (US and international), as well as our Partners, when necessary. When reporting such information, Rightdevice does not share Personal Data without prior user consent. We reserve the right, however, to contact users for follow-up at the request of regulatory agencies and our Partners.

We will never sell your Personal Data for non-Rightdevice usage unless you provide specific consent to do so.

Transfer Of Data

Your information, including Personal Data, may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction. If you are located outside the United States and choose to provide information to us, please note that we transfer the data, including Personal Data, to the United States and process it there. As a result, your submission of Personal Data to us is governed by the laws of the United States and the State of California.

Your consent to this Agreement, followed by your submission of such information represents your agreement to that transfer.

Rightdevice will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Agreement, and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls and assurances in place including the security of your data and other Personal Data.

Rightdevice provides California residents with the option to opt-out to sharing of "personal information" as defined by California's "Shine the Light" law with third parties, including our affiliates, for such third parties' own direct marketing purposes. California residents may exercise that opt-out, and/or request information about Rightdevice's compliance with the Shine the Light law, by contacting Rightdevice at [email protected] or by sending a letter to Rightdevice, Inc. at 1025 Prospect Street, Suite 350, La Jolla, CA 92037. Requests must include "California Privacy Rights Request" in the first line of the description and include your name, street address, city, state, and ZIP code. Please note that Rightdevice is only required to respond to one request per user each year.

Disclosure Of Data Legal Requirements

Rightdevice may disclose your Personal Data in the good faith belief that such action is necessary to:

1. To comply with a legal obligation.
2. To protect and defend the rights or property of Rightdevice.
3. To prevent or investigate possible wrongdoing in connection with the Service.
4. To protect the personal safety of users of the Service or the public.
5. To protect against legal liability.

Other Special Cases

There are instances, not covered above, where your Non-Identifying Data, Personal Data, and Usage Data may be used and disclosed, including, but not limited to, the following:

1. Rightdevice may use your data in the case of an emergency or other circumstance that we determine requires a member of Rightdevice's team to directly contact the user (for example, a data breach that puts the user's data at risk).

Rightdevice may transfer your data to any successor to its business as a result of any merger, acquisition, asset sale, bankruptcy proceeding, or similar transaction or event. Users will be made aware of any changes in the current privacy policy that result from such a transfer.

Your Privacy Rights

You have the rights listed below. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law.

1. Access: You can request a copy of the Personal Data that we have collected about you.
2. Correction: You can request that we correct inaccurate Personal Data that we have collected about you.
3. Deletion: You can request that we delete your Personal Data. Please note that once we process a deletion request, we may be unable to provide access or support to any past products or services you have engaged with using the Service.

You may submit requests to exercise these rights at: https://patientpartner.com/contact-us or by mailing us at 1025 Prospect Street #350, La Jolla, CA 92037. We cannot process a request if you do not provide us with sufficient information to allow us to understand and respond appropriately.

Your State Privacy Rights

State consumer privacy laws may provide their residents with additional rights regarding our use of their personal information.

Many states provide (now or in the future) their state residents with rights to:

1. Confirm whether we process their personal information.
2. Correct inaccuracies in their personal information, taking into account the information's nature and processing purpose (excluding Iowa and Utah).
3. Data portability.
4. Opt-out of personal data processing for:
5. targeted advertising (excluding Iowa);
6. sales; or
7. profiling in furtherance of decisions that produce legal or similarly significant effects (excluding Iowa and Utah).
8. Either limit (opt-out of) or require consent to process sensitive personal data.
9. The exact scope of these rights may vary by state. To exercise any of these rights please send us an email with your request to [email protected]. To appeal a decision regarding a consumer rights request please send us an email with your notice of appeal to [email protected].

International Transfer

Rightdevice is based in the United States, and the information Rightdevice collects is governed by United States law. If you access the Service from outside of the United States, please be aware that information collected through the Service may be transferred to, processed, stored and used in the United States. Data protection laws in the United States may be different from those of your country of residence. Your use of the Service or provision of any information therefore constitutes your consent to and from, processing, usage, sharing, and storage of your information, including Personal Data, to the United States as set forth in this Agreement.

GOVERNING LAW AND SERVICE USERS FROM OUTSIDE THE UNITED STATES

As previously stated, we and our servers are located in the United States and are subject to the applicable United States local and national laws. These laws may not have equivalent privacy protection as those in your country of residence.

When we share information about you with our various Service Providers, the data-sharing agreement includes data protection clauses. Rightdevice adheres to the EU-U.S. DPF Principles with regard to personal data transferred from the European Union and the United Kingdom. Rightdevice does not adhere to the Swiss-U.S. DPF Principles with regard to personal data transferred from Switzerland. We also comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF.

Those who choose to access the Service do so on their own initiative and understanding that their use of the Service and use of the Non-Identifying Data, Personal Data, and Usage Data may be subject to EU, UK, and US laws and regulations, including the GDPR. If users choose to access or use the Service, they consent to the use and disclosure of information (including GDPR "special category" data such as race, ethnicity, and data concerning health) in accordance with this Agreement and subject to such laws. Transfer of data from residents of the EU/EEA/UK is done under this consent and also for the purpose of providing Service to those users, as allowed by Article 49 of the GDPR.

Rightdevice complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF. Rightdevice has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of Personal Data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this Agreement and the EU-U.S. DPF Principles, the Principles shall govern.

We acknowledge the right of EU and UK individuals to access their Personal Data under the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Users wishing to exercise this right may do so by contacting us at [email protected].

We will also provide EU and UK individuals with opt-out or opt-in choices before we share their data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected or subsequently authorized. To request to limit the use and disclosure of your personal information, you may do so by contacting us at [email protected].

General Data Protection Regulation (GDPR)

All individuals have rights regarding their data. The European Union's (EU) General Data Protection Regulations (GDPR) describes these rights in law. They include:

1. You have the right to clear and transparent communication about your data. We want to make this Agreement as clear as possible to help you understand it.
2. You have the right to request a copy of your data in a common digital format. To request this information, please contact our team at [email protected].
3. You have the right to edit or correct your data. You can edit most of your information on the Service. If you need help with this, contact our team at [email protected].
4. You have the right to request that your data be deleted. To do this, contact our team at [email protected].
5. You have the right to be notified of any breach involving your data. We will notify the appropriate data protection authority within 72 hours of detecting a breach involving your data. We will notify you as soon as possible after that.
6. You have the right to object to the processing of your data. You may decline any consent request to share your identifying data with a third-party partner, and this will have no impact on your use of the Service. For clarity, we may still share with our third-party partners data regarding you that does not identify you and is not connected with you. You may request to delete your account at any time (see Your Privacy Rights above).

In some cases, these rights might be restricted. Some examples would include where the information requested compromises the privacy of another user or is the subject of legal proceedings or investigation. Additionally, processing that has already occurred cannot be undone. If you have questions or complaints about our handling of these rights, see the information at the end of this Agreement.

What are the Legal Bases for Our Collection and Use of Your Data?

GDPR sets out a number of possible bases, three of which apply to Rightdevice and the Service:

1. We need to use some identifying information just to operate the Service. This includes your email address, username, password, and IP address, among other items.
2. We use your data for research with your consent, as described in this Agreement. We will always ask for your additional, explicit consent before sharing identifying information with our third-party partners (as described in further detail below).
3. In rare cases, we may need to share your data to comply with a legal obligation. See "Other Special Cases" above.
4. If you are a resident of the European Union or the UK and have a complaint about our use or processing of your data, you have the right to lodge a complaint with a national Data Protection Authority. The UK and each European Union member nation have established their own Data Protection Authority; you can find out about the Data Protection Authority in your country.
5. Personal Information: Any reference or mention to "personal information" or Personal Data in this Agreement is equivalent to "personal data" governed by European data protection legislation.
6. Controller: Rightdevice is the designated controller of your personal information covered by this Agreement for purposes of European data protection legislation. We have an appointed Data Protection Officer, who can be reached via email at [email protected].
7. Other Purposes: We may use your Personal Data for reasons not described in this Agreement where permitted by law and the reason is compatible with the purpose for which we collected it. If we need to use your Personal Data for an unrelated purpose, we will actively reach out to notify you, explain the applicable legal basis, and obtain your consent. We may also re-disclose such information for legally permissible reasons. Such re-disclosure is, in some cases, not prohibited by California law and may no longer be protected by federal confidentiality law (e.g, HIPAA). However, California law prohibits the person receiving your Personal Data from making further disclosures of it unless another authorization is obtained from you or unless such disclosure is specifically required or permitted by law. In addition, only those individuals who have a reason to review your Personal Data, in conjunction with our performance of the Service, will be permitted access to your Personal Data, and only the minimally necessary Personal Data required for the performance of such tasks and functions.
   
   You may submit requests regarding the handling of your data by emailing [email protected]. We may request specific information from you to help us confirm your identity and process your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions. You can find your data protection regulator here.
8. Cross-Border Data Transfer
   
   If we transfer your personal information from the United Kingdom or European Economic Area to another country, such that we are required to apply additional safeguards to your personal information under European data protection laws, we will do so.

Security of Data

The security of your data is important to us, but remember that no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

Service Providers

We may employ third-party companies, vendors, and individuals to help facilitate or provide the Service on our behalf, perform Service-related services, or to assist us in analyzing how our Service is used. If necessary, these third parties may have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

Partners

Partners refers to the customers, clients, and affiliates of Rightdevice that engage our Service, as well as third parties authorized to act on their behalf. This includes, but is not limited to: pharmaceutical and biotechnology companies, medical device and diagnostics companies, contract research organizations (CROs) and clinical research sites, hub service providers and patient support program administrators, and marketing, media, advertising, and digital agencies retained by any of the foregoing. Any sharing of Personal Data with Partners is governed by binding written agreements that restrict use of the data to the purposes set forth in this Agreement.

Links to Other Sites

Our Service may contain links to other sites that are not operated by us. If you click a third-party link, you will be directed to that third party's site. We strongly advise you to review the privacy policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Children's Privacy

Our Service does not address anyone under the age of 18 or if a lower age is permitted under applicable law ("Children" or "Child") except if previously consented to by a parent or guardian of the Child, or if the Child is an emancipated minor. Unless any of the foregoing exceptions exist, and only to that extent. We do not knowingly collect personally identifiable information from anyone who is a Child. If you are a parent or guardian and you are aware that your Child has provided us with Personal Data, and you have not provided us with consent, please contact us. If we become aware that we have collected Personal Data from children without verification of parental consent, we will take steps to remove that information from our servers.

Changes to our Privacy Policy

We may update our privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page. We will let you know via email and/or a prominent notice on our Service, prior to the change becoming effective, and update the "effective date" at the top of the privacy policy page. Your use of the Service indicates your consent to the Privacy Policy posted at the time of use. However, we will not treat your previously collected Personal Data, to the extent it is not collected under the new privacy policy, in a manner materially different than represented at the time it was collected without your consent. To the extent any provision of this Privacy Policy is found by a competent tribunal to be invalid or unenforceable, such provision shall be severed to the extent necessary for the remainder to be valid and enforceable.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Execution of this Agreement authorizes the disclosure and use of your Personal Data. Your consent to the terms contained in this Agreement shall continue until such time as you revoke it and notify us, in writing, and submit it to the following mailing address Attn: Rightdevice, Inc., 1025 Prospect Street, Suite 350. La Jolla, California, 92037 or via email: [email protected]

Your revocation will take effect upon receipt, except to the extent that others have acted in reliance upon this authorization.

You have a right to receive a copy of this authorization.

Contact Us

If you have any questions about this Agreement, please contact us by email: [email protected].

Last Updated: May 18, 2026