Page 1 of 1

Privacy Policy

PRIVACY POLICY Effective Date: ___ January, 2026 Last Updated: ___ January, 2026 This Privacy Policy (“Policy”) describes how Embraya, Inc. (“Embraya,” “we,” “us,” or “our”) collects, uses, discloses, and protects information when you access or use our website(s) and related online properties (including our blog), mobile application(s), and other services we provide (collectively, the “Services”). Important note for users: The Services may involve information that is sensitive in nature (including reproductive health information). Please read this Privacy Policy carefully. This Privacy Policy applies to all users of the Services and should be read together with our Terms of Use. By accessing or using the Services, you consent to the practices described in this Policy. I. PLATFORM PURPOSE & NON-CLINICAL NATURE The Platform provides digital organizational, educational, emotional-support, and self- tracking tools designed to assist individuals navigating fertility, pregnancy, postpartum, and family-building journeys. Embraya is not a medical provider. The Platform does not provide medical advice, diagnosis, treatment, clinical recommendations, or healthcare services and does not create a provider- patient relationship. All content is provided for informational, organizational, and self-management purposes only. You are solely responsible for all health-related decisions. II. BETA PROGRAM; PRE-RELEASE SERVICES DISCLAIMER The Services are currently offered, in whole or in part, as a beta, pilot, or pre-release program and are still under active development. Certain features may be incomplete, inaccurate, unavailable, subject to interruption, or may change, malfunction, or be discontinued at any time without notice. If you are actively in a treatment cycle, Embraya deeply values your feedback and welcomes your insights regarding how the Services function in real-world use. Such feedback is voluntary and provided solely for product improvement purposes. You acknowledge and agree that: • The Services may not operate correctly, consistently, or reliably; • Information, reminders, notifications, data displays, and other outputs may be delayed, incomplete, inaccurate, or unavailable; • You remain solely responsible for verifying all medications, dosages, timing, appointments, protocols, and treatment instructions directly with your healthcare providers; • The Services are not intended to be relied upon as a sole or primary source of truth for any clinical decision or treatment action; Embraya shall not be liable for any missed medications, missed appointments, delayed treatments, adverse outcomes, emotional distress, or any damages or losses arising from or relating to your participation in the beta or use of any pre-release Services. Your participation in the beta is voluntary, and by continuing to use the Services, you expressly acknowledge that you are using the beta Services at your own risk and that they are not a substitute for professional medical advice, diagnosis, or treatment. 1. Scope and Application This Privacy Policy applies to information we collect through the Services, including when you: • visit our website or blog; • create an account or use the Embraya app; • submit forms (e.g., “Contact”); • communicate with us (email, in-app messages, customer support). This Privacy Policy does not apply to third-party websites, apps, or services that may be linked from our Services or integrated with them. We are not responsible for third-party privacy practices. 2. Information We Collect We collect information in three ways: (A) information you provide, (B) information collected automatically, and (C) information from third parties (if you choose to connect them). A. Information You Provide Depending on how you use the Services, you may provide: • Identifiers and account data: name, email address, password or authentication method, account preferences. • Support and communications: the content of messages you send us, including contact forms and customer support inquiries (our “Contact” page references agreement to a privacy policy). • User inputs and self-tracking data: information you enter into the app (for example, fertility and family-building journey information, medication and inventory details, symptoms, journaling entries, reflections, and similar logs). Embraya’s features include medication inventory tracking/alerts, journaling, and educational content. B. Information Collected Automatically When you access the Services, we (and our service providers) may automatically collect: • Device and usage data: device type, operating system, app version, browser type, IP address, time zone, language, app/website interaction data, pages/screens viewed, links clicked, session duration, crash logs, and diagnostic data. • Cookies and similar technologies: cookies, pixels, SDKs, and similar tools used for site/app functionality, analytics, and security (see Section 6). C. Information From Third Parties (If Enabled) If we offer integrations (now or in the future) and you choose to connect them, we may receive information from third-party services (for example, calendar providers or authentication providers) consistent with your settings and the third party’s policies. 3. Consumer Health Data and Sensitive Information The Services are designed to support users navigating fertility, IVF, and family-building. As a result, information you provide may include sensitive information, including information that could be considered consumer health data under certain laws (including Washington’s My Health My Data Act, which was enacted to protect health data outside HIPAA). Please see Embraya’s Consumer Health Data Privacy Policy linked here_________________ We treat such information with heightened care, including by limiting access, implementing security controls, and restricting disclosures as described below. 4. How We Use Information We use information for the following business and operational purposes: • Provide and operate the Services, including creating and managing accounts, enabling core functionality (including medication inventory tracking/alerts, journaling, and educational content), and delivering requested features. • Personalize your experience, such as saving preferences and delivering relevant in-app experiences. • Communicate with you, including responding to requests, sending administrative messages, service updates, security notices, and (where permitted) product announcements. • Improve, test, and develop the Services, including troubleshooting, analytics, research and development, feature optimization, and quality assurance. • Security and integrity, including fraud prevention, abuse prevention, and enforcing our Terms. • Compliance and legal obligations, including responding to lawful requests and protecting rights, safety, and property. 5. How We Disclose Information We do not sell your personal information. We disclose information only as described below: A. Service Providers We disclose information to vendors and service providers who perform services on our behalf, such as hosting, analytics, customer support, communications delivery, security monitoring, and other technical operations. They are authorized to use information only as necessary to provide services to us under contractual obligations. B. Affiliates and Corporate Transactions We may disclose information to our corporate affiliates (if any), consistent with this Privacy Policy. We may also disclose information in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, where information may be transferred as part of that transaction. C. Legal, Safety, and Rights We may disclose information if we believe in good faith that disclosure is necessary to: • comply with law or legal process; • respond to lawful requests by public authorities; • protect the rights, property, or safety of Embraya, our users, or others; • investigate and prevent suspected fraud, abuse, or security issues. D. With Your Direction or Consent We may disclose information when you direct us to do so or provide consent (for example, if you choose to share certain information externally). 6. Cookies, Analytics, and Similar Technologies We use cookies and similar technologies for: • essential site/app functionality; • security and fraud prevention; • analytics and performance measurement. You can control cookies through your browser settings; blocking certain cookies may affect site functionality. For mobile apps, your device settings may allow you to limit certain tracking technologies (availability varies by platform). 7. De-Identified and Aggregated Information We may create and use de-identified and/or aggregated information that does not reasonably identify you. We may use such information for analytics, product improvement, research, and business purposes. Where required by law, we will maintain and use de-identified information in de-identified form and not attempt to re-identify it except as permitted by law. 8. Data Retention We retain information for as long as reasonably necessary to: • provide the Services; • comply with legal obligations; • resolve disputes and enforce agreements; and • protect the security and integrity of the Services. Retention periods may vary depending on the nature of the data, user settings, and legal requirements. We may retain de-identified/aggregated data longer where permitted by law. 9. Security We implement administrative, technical, and physical safeguards designed to protect information. Embraya states that it is built with “HIPAA-compliant security standards” and that personal and medical information is encrypted and stored safely. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. 10. HIPAA Notice (Clarification) Embraya is not a healthcare provider and the Services are generally not intended to be a HIPAA- regulated “covered entity” service. If Embraya ever operates as a business associate to a covered entity for specific services, we will address HIPAA obligations through appropriate agreements and disclosures for those specific arrangements. 11. Your Privacy Rights and Choices (U.S.) Depending on your state of residence, you may have rights such as: • Access/Know: request access to certain information we maintain about you; • Delete: request deletion of certain information; • Correct: request correction of inaccurate personal information; • Portability: request a copy of certain information in a portable format; • Opt-out: opt out of certain targeted advertising, profiling, or sales/sharing (as applicable and defined by law); • Withdraw consent: where processing is based on consent. We will not discriminate against you for exercising privacy rights. How to Submit a Request Email us at [email protected]m" target="_blank">[email protected] with the subject line “Privacy Rights Request.” We may need to verify your identity before processing requests. Authorized Agents Where required by law (e.g., certain state laws), you may use an authorized agent to submit requests on your behalf. We may require proof of authorization and identity verification. Appeals (Where Applicable) If we deny a request, you may have the right to appeal. Instructions will be provided in our response. 12. Washington Consumer Health Data (My Health My Data Act) If you are a Washington resident, or if the law otherwise applies, certain information may be considered consumer health data, and you may have additional rights, including rights to confirm, access, delete, or withdraw consent for certain processing, subject to legal exceptions. Washington law also restricts “selling” consumer health data without separate, valid authorization and is intended to protect health data outside HIPAA. To learn more, please see Embraya’s Consumer Health Data Privacy Policy linked here_________________ To exercise these rights, contact us as described in Section 11. 13. Children’s Privacy As mentioned in the Terms, by accessing or using the Services, you represent and warrant that you are at least eighteen (18) years old and legally capable of entering into binding contracts. Embraya does not knowingly permit use of the Services by minors and does not seek or accept parental consent for use by individuals under eighteen (18). If Embraya becomes aware or has reason to believe that a user is under eighteen (18), Embraya may immediately suspend or terminate the account, delete any associated data, and deny continued access, without notice. You agree that Embraya shall have no liability for any damages, losses, or claims arising from any use of the Services by individuals under eighteen (18), including any unauthorized or misrepresented use. 14. International Users If you access or use the Services from outside the United States, you acknowledge and agree that your information may be transferred to, processed, stored, and accessed in the United States and in other jurisdictions where Embraya or its service providers maintain facilities or operations. These jurisdictions may have data protection and privacy laws that are different from, and in some cases less protective than, the laws of your country of residence. By accessing or using the Services, you expressly consent to the transfer, processing, storage, and use of your information in accordance with this Privacy Policy and applicable U.S. law. 15. Disclaimers & Limitation of Liability 10.1 “As Is.” THE SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTY OF ANY KIND. 10.2 No Warranty. Embraya does not warrant that the Services will be uninterrupted, error-free, or secure. 10.3 Limitation of Damages. TO THE MAXIMUM EXTENT PERMITTED BY LAW, EMBRAYA SHALL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES, INCLUDING LOSS OF DATA OR DAMAGES RESULTING FROM YOUR USE OF THE SERVICES. 10.4 Cap on Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EMBRAYA’S TOTAL AGGREGATE LIABILITY TO YOU FOR ANY AND ALL CLAIMS, DEMANDS, LOSSES, DAMAGES, COSTS, EXPENSES, AND CAUSES OF ACTION OF ANY KIND OR NATURE WHATSOEVER, WHETHER ARISING IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, WARRANTY, STATUTE, OR OTHERWISE, ARISING OUT OF OR RELATING TO THE TERMS, THE SERVICES, THE PRIVACY POLICY OR THE CHDP POLICY OR YOUR USE OF OR INABILITY TO USE THE SERVICES, SHALL NOT EXCEED THE GREATER OF: (A) THE TOTAL AMOUNT ACTUALLY PAID BY YOU TO EMBRAYA IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM; OR (B) ONE HUNDRED U.S. DOLLARS (US $100). 11. Indemnification You agree to indemnify, defend and hold harmless Embraya, its affiliates, and their respective officers, directors, employees, agents, contractors, licensors, and service providers from and against any and all claims, demands, actions, proceedings, liabilities, losses, damages, judgments, settlements, penalties, fines, costs, and expenses (including reasonable attorneys’ fees and court costs) arising out of or relating to your use of or access to the Services, your violation of the Terms, the Privacy Policy or the CHDP Policy, your User Content, your breach of any representation or warranty herein, or your actual or alleged infringement, misappropriation, or violation of any third- party rights. 12. Governing Law & Jurisdiction Any dispute, claim, or controversy arising out of or relating to the Services, the Terms, the Privacy Policy or the CHDP Policy, shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles. You and Embraya agree that the state and federal courts located within the State of Delaware shall have exclusive jurisdiction and venue over any dispute, claim, or proceeding arising out of or relating to the Terms, the Services, the Privacy Policy or the CHDP Policy, and you hereby irrevocably consent to the personal jurisdiction and venue of such courts. To the maximum extent permitted by applicable law, you agree to waive any right to participate in any class, collective, or representative action, and agree that any claims may be brought solely in your individual capacity and not as a plaintiff or class member in any purported class, collective, or representative proceeding. 13. Changes to This Privacy Policy Embraya reserves the right, in its sole discretion, to modify, amend, supplement, or replace this Policy at any time. We may provide notice of material changes as required by applicable law. Your continued access to or use of the Services after any modification becomes effective constitutes your binding acceptance of the revised Policy, and if you do not agree to the modified Policy, your sole remedy is to discontinue use of the Services and close your account. 14. Contact Information For questions, concerns, or requests regarding this Privacy Policy, contact: [email protected]