Privacy Policy

This Privacy Policy describes how PrimeDose (the “Company,” “PrimeDose,” “we,” or “us”), collects, uses, discloses, and safeguards information in connection with the PrimeDose device, mobile application, and website (collectively, the “Services”). By accessing or using the Services, you agree to the collection and use of information as described in this Policy. This Policy is incorporated into, and should be read together with, the PrimeDose Terms of Service.

1. Definitions

For purposes of this Policy, the following terms have the meanings set out below.

• “Personal Information” means information that identifies, relates to, or could reasonably be linked with a particular individual.
• “Health Information” means information relating to an individual’s physical or mental health, health conditions, or medication use, including dosing schedules and adherence records generated by the Device.
• “Device” means the PrimeDose hardware unit used to store, schedule, and dispense medication.
• “Caregiver” means any individual granted access to a user’s account and Health Information by that user or, in an institutional setting, by a Facility.
• “Facility” means a senior living community, assisted living community, or similar institutional customer that deploys the Device to its residents.
• “Protected Health Information” or “PHI” has the meaning given to it under the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”).

2. Information we collect

2.1 Information provided directly. The Company collects information that a user, Caregiver, or Facility administrator provides directly, which may include:

• Full name, email address, telephone number, and mailing address
• Date of birth and, where applicable, zip code
• Health conditions entered by the user or a Caregiver
• Medication information, including prescription and over-the-counter drug names, dosing schedules, and whether a given dose was taken on time, taken late, or missed
• Notes or self-reported information a user chooses to add
• Contact information for any Caregiver invited to an account
• Payment details submitted at the time of purchase, processed by a third-party payment processor; the Company does not store complete payment card numbers

2.2 Information collected automatically. When the Services are used, the Company automatically receives certain technical information, including IP address, device and browser type, and pages or features accessed. The Device separately records and transmits dose scheduling and status information to the associated account over the user’s Wi-Fi network.

3. Use of information

The Company uses the information described in Section 2 to:

• Provide, operate, and maintain the Services
• Establish and administer user accounts and any associated Caregiver or Facility connections
• Deliver dose alerts, reminders, and compliance reporting to authorized users and Caregivers
• Respond to support requests and communicate about the Services
• Satisfy legal and regulatory obligations, including obligations to the U.S. Food and Drug Administration where applicable
• As described in Section 4, for the Company’s own marketing purposes

4. Marketing use of health and medication information

In addition to the uses described in Section 3, the Company may use Health Information, including medication and adherence data, to identify products, features, or offers that may be relevant to a user, and to contact the user about them. By using the Services, a user agrees to this use of the user’s Health Information for the Company’s own marketing purposes. This Policy does not authorize, and the Company does not engage in, the sale or disclosure of Health Information to unrelated third parties for those third parties’ independent marketing use.

A user may withdraw from marketing communications at any time by following the unsubscribe instructions included with any marketing message, or by submitting a request to [usprimedose@outlook.com]. Withdrawal from marketing does not affect service communications, such as dose alerts, which are required to operate the Services and are not considered marketing.

5. Health information and HIPAA

Where a Facility is a covered entity under HIPAA, the Company acts as that Facility’s business associate pursuant to a written Business Associate Agreement, and handles PHI received in that capacity in accordance with HIPAA’s Privacy and Security Rules. In the event of any conflict between this Policy and the terms of an applicable Business Associate Agreement, the Business Associate Agreement controls.

Where an individual purchases or uses the Services directly and not in connection with a covered entity, HIPAA may not apply of its own force. The Company nonetheless applies administrative, technical, and physical safeguards to Health Information consistent with those required under HIPAA, regardless of whether HIPAA independently governs a particular relationship.

6. Caregiver, family, and facility access

Where a user or a Facility authorizes a Caregiver to access an account, the Company will share relevant dose and schedule information with that Caregiver, including whether a dose was taken on time, taken late, or missed. Access granted to a Caregiver may be revoked at any time by the user or, in an institutional setting, by the Facility, through account settings. Revocation stops future disclosures to that Caregiver but does not affect information already provided to them.

7. Cookies and tracking technologies

The Services use cookies and similar technologies for two purposes: maintaining essential functionality, such as keeping a user signed in, and first-party analytics used to understand and improve use of the Services. The Company does not use advertising or retargeting cookies and does not share cookie or usage data with advertising networks or measurement partners. A user may control cookie settings through the user’s browser, though disabling essential cookies may limit the functionality of the Services.

8. Disclosure of information

Apart from the Caregiver and Facility access described in Section 6, the Company may disclose information to:

• Service providers. Vendors engaged to support the Services, such as hosting, payment processing, and customer support providers, bound by agreements limiting their use of information to the services they provide the Company.
• Regulators. The U.S. Food and Drug Administration or other applicable authorities, where required, including in connection with recalls or adverse event reporting.
• Law enforcement and safety. Parties to whom disclosure is, in the Company’s good faith judgment, necessary to comply with legal process or to prevent serious harm.
• Successors. A successor entity in connection with a merger, acquisition, or transfer of assets, with notice provided where required by law.
• De-identified or aggregated data. Third parties, where information has been de-identified or aggregated such that it no longer identifies any individual.

The Company does not sell Personal Information to third parties for those parties’ own independent marketing purposes.

9. Data security

The Company maintains administrative, technical, and physical safeguards designed to protect information, including encryption of data in transit and at rest, and a two-factor verification process built into the Device to confirm each dispensed dose. Accounts are protected by a password, and users are responsible for maintaining the confidentiality of their credentials.

Because the Device is a physical product, the Company is not responsible for the security of information residing on a Device that is outside a user’s possession or control, including while in transit for shipment, service, or return. Users are responsible for physically securing the Device and removing Personal Information from it when it is not in their possession.

No method of transmission or storage is completely secure. In the event of a security incident affecting Personal Information, the Company will provide notice to affected individuals and applicable regulators as required by law.

10. Your rights and choices

Users may access, update, or delete much of the information associated with their account, including contact details, medications, health conditions, and Caregiver connections, through account settings. Certain information may not be available for self-service deletion where retention is necessary to provide the Services, comply with law, or satisfy obligations to a Facility.

Depending on a user’s state of residence, additional rights may be available under state privacy law, potentially including rights to confirm, correct, delete, or limit the disclosure of Personal Information.

11. Data retention

The Company retains information for as long as an account remains active and for an additional period thereafter as necessary to comply with legal obligations, resolve disputes, and satisfy recordkeeping requirements applicable to medical devices.

12. Children's privacy

The Company’s general website and marketing services are not directed to children under thirteen, and the Company does not knowingly collect Personal Information from children under thirteen except as consistent with the Children’s Online Privacy Protection Act. The Device is intended to be purchased and used by adults, or used by an individual of any age solely under the direct supervision of an adult, such as a parent, legal guardian, or authorized Caregiver. If the Company learns that it has collected Personal Information from a child under thirteen without appropriate consent, that information will be deleted promptly. A parent or guardian with questions may contact [usprimedose@outlook.com].

13. International users

The Services are currently offered within the United States, and information is hosted and processed in the United States.

14. Changes to this policy

The Company may revise this Policy from time to time. Material changes will be communicated by posting an updated version on the website or app, or by direct notice to users, prior to the effective date of the change. Continued use of the Services following such notice constitutes acceptance of the revised Policy.

15. Governing law

This Policy is governed by the laws of the State of New Jersey, without regard to conflict of law principles, to be confirmed by counsel and made consistent with the Terms of Service.

16. Contact information

Questions regarding this Policy may be directed to usprimedose@outlook.com.