Page 1 of 1

Privacy Policy

PRIVACY POLICY

Effective Date: 18 January, 2026

Last Updated: 27 February, 2026

This Privacy Policy (“Policy”) describes how Embraya, Inc. (“Embraya,” “we,” “us,” or “our”) collects, uses, discloses, and protects information when you access or use our website(s) and related online properties (including our blog), mobile application(s), and other services we provide (collectively, the “Services”).

Important note for users: The Services may involve information that is sensitive in nature (including reproductive health information). Please read this Privacy Policy carefully.

This Privacy Policy applies to all users of the Services and should be read together with our Terms of Use. By accessing or using the Services, you consent to the practices described in this Policy.

PLATFORM PURPOSE & NON-CLINICAL NATURE

The Platform provides digital organizational, educational, emotional-support, and self-tracking tools designed to assist individuals navigating fertility, pregnancy, postpartum, and family-building journeys.

Embraya is not a medical provider. The Platform does not provide medical advice, diagnosis, treatment, clinical recommendations, or healthcare services and does not create a provider-patient relationship.

All content is provided for informational, organizational, and self-management purposes only. You are solely responsible for all health-related decisions.

BETA PROGRAM; PRE-RELEASE SERVICES DISCLAIMER

The Services are currently offered, in whole or in part, as a beta, pilot, or pre-release program and are still under active development. Certain features may be incomplete, inaccurate, unavailable, subject to interruption, or may change, malfunction, or be discontinued at any time without notice.

If you are actively in a treatment cycle, Embraya deeply values your feedback and welcomes your insights regarding how the Services function in real-world use. Such feedback is voluntary and provided solely for product improvement purposes.

You acknowledge and agree that:

The Services may not operate correctly, consistently, or reliably; Information, reminders, notifications, data displays, and other outputs may be delayed, incomplete, inaccurate, or unavailable; You remain solely responsible for verifying all medications, dosages, timing, appointments, protocols, and treatment instructions directly with your healthcare providers; The Services are not intended to be relied upon as a sole or primary source of truth for any clinical decision or treatment action;

Embraya shall not be liable for any missed medications, missed appointments, delayed treatments, adverse outcomes, emotional distress, or any damages or losses arising from or relating to your participation in the beta or use of any pre-release Services.

Your participation in the beta is voluntary, and by continuing to use the Services, you expressly acknowledge that you are using the beta Services at your own riskand that they are not a substitute for professional medical advice, diagnosis, or treatment.

1. Scope and Application

This Privacy Policy applies to information we collect through the Services, including when you:

visit our website or blog; create an account or use the Embraya app; submit forms (e.g., “Contact”); communicate with us (email, in-app messages, customer support).

This Privacy Policy does not apply to third-party websites, apps, or services that may be linked from our Services or integrated with them. We are not responsible for third-party privacy practices.

2. Information We Collect

We collect information in three ways: (A) information you provide, (B) information collected automatically, and (C) information from third parties (if you choose to connect them).

A. Information You Provide

Depending on how you use the Services, you may provide:

Identifiers and account data: name, email address, password or authentication method, account preferences. Support and communications: the content of messages you send us, including contact forms and customer support inquiries (our “Contact” page references agreement to a privacy policy).  User inputs and self-tracking data: information you enter into the app (for example, fertility and family-building journey information, cycle-related data, medication and inventory details, symptoms, journaling entries, reflections, and similar logs). Embraya’s features include medication inventory tracking/alerts, journaling, and educational content. 

B. Information Collected Automatically

When you access the Services, we (and our service providers) may automatically collect:

Device and usage data: device type, operating system, app version, browser type, IP address, time zone, language, app/website interaction data, pages/screens viewed, links clicked, session duration, crash logs, and diagnostic data, and other similar information. Cookies and similar technologies: cookies, pixels, SDKs, and similar tools used for site/app functionality, analytics,  security (see Section 6), and other information. 

C. Information From Third Parties (If Enabled)

If we offer integrations (now or in the future) and you choose to connect them, we may receive information from third-party services (for example, calendar providers or authentication providers) consistent with your settings and the third party’s policies.

3. Consumer Health Data and Sensitive Information

The Services are designed to support users navigating fertility, IVF, and family-building. As a result, information you provide may include sensitive information, including information that could be considered consumer health data under certain laws (including Washington’s My Health My Data Act, which was enacted to protect health data outside HIPAA i.e., Health Insurance Portability and Accountability Act). Please see Embraya’s Consumer Health Data Privacy Policy (“CHDP”) linked here_________________

We treat such information with heightened care, including by limiting access, implementing security controls, and restricting disclosures as described below.

4. How We Use Information

We use information for the following business and operational purposes:

Provide and operate the Services, including creating and managing accounts, enabling core functionality (including medication inventory tracking/alerts, journaling, and educational content), and delivering requested features.  Personalize your experience, such as saving preferences and delivering relevant in-app experiences. Communicate with you, including responding to requests, sending administrative messages, service updates, security notices, and (where permitted) product announcements. Improve, test, and develop the Services, including troubleshooting, analytics, research and development, feature optimization, and quality assurance. Security and integrity, including fraud prevention, abuse prevention, and enforcing our Terms. Compliance and legal obligations, including responding to lawful requests and protecting rights, safety, and property.

5. How We Disclose Information

We do not sell your personal information or consumer health data, and we do not share consumer health data for targeted advertising. We disclose information only as described below:

A. Service Providers

We disclose information to vendors and service providers who perform services on our behalf, such as hosting, analytics, customer support, communications delivery, security monitoring, and other technical operations. They are authorized to use information only as necessary to provide services to us under contractual obligations.

B. Affiliates and Corporate Transactions

We may disclose information to our corporate affiliates (if any), consistent with this Privacy Policy. We may also disclose information in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, where information may be transferred as part of that transaction.

C. Legal, Safety, and Rights

We may disclose information if we believe in good faith that disclosure is necessary to:

comply with law or legal process; respond to lawful requests by public authorities; protect the rights, property, or safety of Embraya, our users, or others; investigate and prevent suspected fraud, abuse, or security issues.

D. With Your Direction or Consent

We may disclose information when you direct us to do so or provide consent (for example, if you choose to share certain information externally).

6. Cookies, Analytics, and Similar Technologies

We use cookies and similar technologies for:

essential site/app functionality; security and fraud prevention; analytics and performance measurement.

You can control cookies through your browser settings; blocking certain cookies may affect site functionality. For mobile apps, your device settings may allow you to limit certain tracking technologies (availability varies by platform).

7. De-Identified and Aggregated Information

We may create and use de-identified and/or aggregated information that does not reasonably identify you. We may use such information for analytics, product improvement, research, grant reporting, service improvement, business purposes, and to advance understanding of fertility and reproductive health trends. Where required by law, we will maintain and use de-identified information in de-identified form and not attempt to re-identify it except as permitted by law. We will retain and use such de-identified or aggregated information indefinitely as permitted by applicable law.

8. Data Retention

We retain information for as long as reasonably necessary to:

provide the Services; comply with legal obligations; resolve disputes and enforce agreements; and protect the security and integrity of the Services. for research and other purposes, as mentioned in clause 7 above.

Retention periods may vary depending on the nature of the data, user settings, and legal requirements. We may retain de-identified/aggregated data longer or indefinitely, where permitted by law. 


9. HIPAA Notice (Clarification)

Embraya is not a healthcare provider, health plan, or healthcare clearinghouse, and the Services are not intended to constitute  HIPAA-regulated “covered entity” services. Accordingly, the Services are generally not designed to create or maintain protected health information (“PHI”) subject to HIPAA. The Services are instead designed for general informational and organizational purposes and are not intended to create or maintain protected health information as defined under HIPAA. Users should not submit sensitive medical or health information through the Services except as necessary for the functionality of the platform and at their own discretion.

10. Security

Embraya implements commercially reasonable administrative, technical, and physical safeguards designed to protect information against unauthorized access, disclosure, alteration, and destruction. These safeguards are based on industry-standard security practices appropriate to the nature of the Services and the information processed.  However, no system, network, or method of transmission over the internet or electronic storage is 100% secure. Accordingly, Embraya cannot guarantee absolute security, uninterrupted availability, or unauthorized access, hacking, data loss, or other breaches will never occur.

To the maximum extent permitted by applicable law, Embraya disclaims any liability for unauthorized access to or alteration of user data, except to the extent resulting from Embraya’s gross negligence or willful misconduct.

Users are responsible for maintaining the confidentiality of their devices, credentials, and account access information.

11. Your Privacy Rights and Choices (U.S.)

Depending on your state of residence, you may have rights such as:

Access/Know: request access to certain information we maintain about you; Delete: request deletion of certain information; Correct: request correction of inaccurate personal information; Portability: request a copy of certain information in a portable format; Opt-out: opt out of certain targeted advertising, profiling, or sales/sharing (as applicable and defined by law); Withdraw consent: where processing is based on consent.

We will not discriminate against you for exercising privacy rights.

How to Submit a Request

Email us at support@embrayaapp.com with the subject line “Privacy Rights Request.”
We may need to verify your identity before processing requests.

Authorized Agents

Where required by law (e.g., certain state laws), you may use an authorized agent to submit requests on your behalf. We may require proof of authorization and identity verification.

Appeals (Where Applicable)

If we deny a request, you may have the right to appeal. Instructions will be provided in our response.

12. Washington Consumer Health Data (My Health My Data Act)

If you are a Washington resident, or if the law otherwise applies, certain information may be considered consumer health data, and you may have additional rights, including rights to confirm, access, delete, or withdraw consent for certain processing, subject to legal exceptions. Washington law also restricts “selling” consumer health data without separate, valid authorization and is intended to protect health data outside HIPAA. To learn more, please see Embraya’s Consumer Health Data Privacy Policy (CHDP) linked here https://tally.so/r/dW06oD

To exercise these rights, contact us as described in Section 11.

13. Children’s Privacy

As mentioned in the Terms, by accessing or using the Services, you represent and warrant that you are at least eighteen (18) years old and legally capable of entering into binding contracts.

Embrayadoes not knowingly permit use of the Services by minors and does not seek or accept parental consent for use by individuals under eighteen (18).

If Embraya becomes aware or has reason to believe that a user is under eighteen (18), Embraya may immediately suspend or terminate the account, delete any associated data, and deny continued access, without notice.

You agree that Embraya shall have no liability for any damages, losses, or claims arising from any use of the Services by individuals under eighteen (18), including any unauthorized or misrepresented use.

14. International Users

If you access or use the Services from outside the United States, you acknowledge and agree that your information may be transferred to, processed, stored, and accessed in the United States and in other jurisdictions where Embraya or its service providers maintain facilities or operations. These jurisdictions may have data protection and privacy laws that are different from, and in some cases less protective than, the laws of your country of residence. By accessing or using the Services, you expressly consent to the transfer, processing, storage, and use of your information in accordance with this Privacy Policy and applicable U.S. law.

15. Disclaimers & Limitation of Liability

15.1 “As Is.” THE SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTY OF ANY KIND.

15.2 No Warranty. Embraya does not warrant that the Services will be uninterrupted, error-free, or secure.

15.3 Limitation of Damages. TO THE MAXIMUM EXTENT PERMITTED BY LAW, EMBRAYA SHALL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES, INCLUDING LOSS OF DATA OR DAMAGES RESULTING FROM YOUR USE OF THE SERVICES.

15.4 Cap on Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EMBRAYA’S TOTAL AGGREGATE LIABILITY TO YOU FOR ANY AND ALL CLAIMS, DEMANDS, LOSSES, DAMAGES, COSTS, EXPENSES, AND CAUSES OF ACTION OF ANY KIND OR NATURE WHATSOEVER, WHETHER ARISING IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, WARRANTY, STATUTE, OR OTHERWISE, ARISING OUT OF OR RELATING TO THE TERMS, THE SERVICES, THE PRIVACY POLICY OR THE CHDP POLICY OR YOUR USE OF OR INABILITY TO USE THE SERVICES, SHALL NOT EXCEED THE GREATER OF: (A) THE TOTAL AMOUNT ACTUALLY PAID BY YOU TO EMBRAYA IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM; OR (B) ONE HUNDRED U.S. DOLLARS (US $100).

16. Indemnification

You agree to indemnify, defend and hold harmless Embraya, its affiliates, and their respective officers, directors, employees, agents, contractors, licensors, and service providers from and against any and all claims, demands, actions, proceedings, liabilities, losses, damages, judgments, settlements, penalties, fines, costs, and expenses (including reasonable attorneys’ fees and court costs) arising out of or relating to your use of or access to the Services, your violation of the Terms, the Privacy Policy or the CHDP Policy, your User Content, your breach of any representation or warranty herein, or your actual or alleged infringement, misappropriation, or violation of any third-party rights.

17. Governing Law & Jurisdiction

Any dispute, claim, or controversy arising out of or relating to the Services, the Terms, the Privacy Policy or the CHDP Policy, shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles, in accordance with clause 14, the dispute resolution clause of Embraya’s Terms of Use.

You and Embraya agree that the state and federal courts located within the State of Delaware shall have exclusive jurisdiction and venue over any dispute, claim, or proceeding arising out of or relating to the Terms, the Services, the Privacy Policy or the CHDP Policy, and you hereby irrevocably consent to the personal jurisdiction and venue of such courts.

To the maximum extent permitted by applicable law, you agree to waive any right to participate in any class, collective, or representative action, and agree that any claims may be brought solely in your individual capacity and not as a plaintiff or class member in any purported class, collective, or representative proceeding.

18. Changes to This Privacy Policy

Embraya reserves the right, in its sole discretion, to modify, amend, supplement, or replace this Policy at any time. We may provide notice of material changes as required by applicable law. Your continued access to or use of the Services after any modification becomes effective constitutes your binding acceptance of the revised Policy, and if you do not agree to the modified Policy, your sole remedy is to discontinue use of the Services and close your account.

19. Contact Information

For questions, concerns, or requests regarding this Privacy Policy, contact: support@embrayaapp.com