EveCare Global Privacy Policy

1. Who We Are

EveCare Health Inc. is a Delaware corporation based in the United States.

EveCare Health India Private Limited supports applicable operations in India.

Depending on the Service you use, the relevant EveCare entity may act as the controller, business, or otherwise responsible organization for your personal information under applicable law.

For privacy questions or requests, contact the Privacy Team, EveCare Health Inc., at support@evecarehealth.com.

2. Our Privacy Commitment

EveCare is designed around the principle that women's health information is personal and should be treated accordingly.

We aim to:

• Collect information that is reasonably necessary to provide and improve the Services
• Use health information for the purposes explained in this Policy
• Restrict access to personal and health information to authorized persons and service providers who need it
• Use reasonable technical, organizational, and administrative safeguards
• Not sell consumer health information
• Not use consumer health information for targeted or behavioral advertising
• Not provide individual health information to an employer for employment decisions
• Not use individual health information for insurance underwriting
• Provide privacy choices and rights required by applicable law
• Delete or de-identify information when required or permitted by applicable law and our retention practices

No method of transmission, storage, or security can be guaranteed to be completely secure.

3. Information We Collect

The information we collect depends on how you use the Services, the features you access, the permissions you grant, and applicable law.

3.1 Account and Profile Information

We may collect:

• Name
• Email address
• Birth year and month
• Country, region, and city
• Profile photograph, where uploaded
• Account credentials and authentication information
• Sign-up method
• Login and account activity information
• IP address and security-related information
• Device identifiers and push-notification identifiers
• Application preferences and settings
• Units and measurement preferences
• Communication preferences and marketing choices
• Information relating to an employer-sponsored or corporate program, where applicable, such as work email, company, or program participation

EveCare does not require you to provide information that is not necessary for a particular feature unless stated otherwise.

3.2 Health, Reproductive, Wellness and Assessment Information

Depending on the features you use, EveCare may collect information that you voluntarily enter, generate, or otherwise provide through the Services, including:

• Menstrual and cycle information
• Period start and end dates
• Cycle settings
• Fertility and ovulation-related information
• Reproductive history
• Pregnancy or postpartum information, where provided
• Perimenopause and menopause-related information
• Symptoms
• Mood
• Sleep-related information
• Lifestyle information
• Weight and body measurements
• Basal body temperature
• Blood pressure
• Blood glucose
• Medical history
• Family health history
• Health conditions or risk factors you choose to provide
• Pelvic-health information
• Breast self-examination information
• Journals or notes
• Health screening information
• Assessment responses and results
• Health Compass inputs, outputs, indicators, bands, drivers, and related history

Some of this information may constitute sensitive personal information, personal health information, consumer health data, or protected health information depending on the applicable law and the circumstances in which EveCare processes it.

4. Assessments and Health Compass

4.1 EveCare Assessments

EveCare offers assessments intended to help users understand their health and identify areas that may warrant attention or discussion with a qualified healthcare professional.

These may include, depending on the Services available to you:

• Menopause Symptom Score (MSS)
• Edinburgh Postnatal Depression Scale (EPDS)
• Breast self-examination screening
• Other EveCare-developed screening or assessment tools

Assessment results are intended for informational, educational, preventive, and self-monitoring purposes. They are not intended to diagnose a disease or medical condition or replace professional medical evaluation.

4.2 Health Compass

Health Compass is a live feature of the EveCare Services.

Health Compass is designed as a preventive and screening-oriented health organization and assessment tool. It helps users organize selected health information across six areas:

1. Cardiovascular/heart health
2. Metabolic/diabetes health
3. Bone health
4. Breast health
5. Cognitive/brain health
6. Pelvic health

Depending on the feature and information you provide, Health Compass may use:

• Demographic information
• Height, weight, and waist measurements
• Blood pressure
• Blood glucose
• Cholesterol information
• Reproductive history
• Personal medical history
• Family history
• Lifestyle information
• Pelvic-health responses
• Other information you voluntarily provide

Health Compass may generate:

• Pillar-specific indicators
• Results
• Screening or risk bands where applicable
• Contributing factors or drivers
• Educational information
• Preventive recommendations
• Prompts to consider discussing particular issues or screening with a qualified healthcare professional

Health Compass uses established published methodologies and screening approaches together with EveCare-developed logic. Depending on the area, these include:

• Cardiovascular/Heart Health: WHO/ISH cardiovascular risk charts (2019)
• Metabolic/Diabetes Health: FINDRISC for diabetes risk assessment
• Cognitive/Brain Health: the published CAIDE methodology for assessment of factors associated with cognitive impairment risk
• Bone, Breast, and Pelvic Health: EveCare-developed screening logic informed by applicable published clinical and preventive-health guidance

Where a third-party methodology or published framework is used, EveCare uses it in accordance with applicable terms and attribution requirements.

The methodology used for a particular result may be identified within the Services and may be updated from time to time.

Health Compass is designed for informational, educational, preventive, and screening purposes. It does not provide a medical diagnosis, constitute a medical test, or replace evaluation, diagnosis, treatment, or advice from a qualified healthcare professional.

Health Compass inputs, calculated results, relevant methodology or model version, drivers, and historical results may be associated with your EveCare account and retained in accordance with Section 13 of this Policy.

5. Information We Generate

When you use the Services, EveCare may generate information from information you provide or from your interaction with the Services.

This may include:

• Cycle calculations
• Estimated fertile or ovulation windows
• Symptom summaries
• Assessment scores
• Health Compass indicators and results
• Risk or screening bands
• Trends and historical summaries
• Reminders
• Personalized educational or preventive information
• Other calculations or outputs necessary to operate the Services

Current cycle and ovulation calculations use date arithmetic and fixed rules, not a predictive model.

6. Device, Location and Usage Information

6.1 Device and Technical Information

Depending on your device and how you use the Services, we may collect:

• Device type and model
• Operating system and version
• Application version
• Device identifiers
• Push-notification identifiers
• App installation identifiers
• IP address
• Network and connectivity information
• Crash and diagnostic information
• Application events
• Screens or feature areas accessed
• Timestamps
• Authentication and security logs
• Other technical information reasonably necessary to operate, secure, troubleshoot, and improve the Services

6.2 Location Information

Depending on your device permissions and the features you use, EveCare may collect device-based location information when you grant the applicable permission.

For example, location information may be used for:

• Determining regional availability
• Location-dependent functionality
• Security and operational purposes
• Regional service configuration
• Providing relevant functionality based on your location

Where device location is unavailable or permission is denied, EveCare may use an IP address to estimate a general location such as country, region, or city.

To work out which country's rules apply to you, the app also reads two settings, without asking for any permission: the country of your App Store or Google Play account, and the region set in your phone's settings. These give us a country only, never your location within it, and we do not use them to track where you are.

EveCare may also retain IP addresses associated with account activity, login events, security functions, and API requests.

When you open one of our shared links (for example a link from a partner or a social media post) and then install the app, we may match the two to understand which link led to the install. To do this we keep a one-way scrambled (hashed) form of your IP address with the link visit for no longer than 30 days, and on Android the app reads the campaign code that Google Play passes to it at install. We do not use advertising identifiers for this, and we do not share it with third parties.

You may manage device location permissions through your device settings, although disabling location may affect certain functionality.

7. How We Use Information

EveCare may use personal information and health-related information for the following purposes, as permitted by applicable law:

• Providing the Services
• Personalization and user experience
• Safety, security and fraud prevention
• Communications
• Analytics and improvement

EveCare's analytics systems are not intended to receive individual health values such as period dates, symptoms, blood pressure, glucose, weight, or assessment answers.

However, certain technical information, such as screens, feature areas, error information, or notification content, may reveal that a health-related feature is being used.

8. Analytics and Service Providers

EveCare uses selected third-party service providers to operate the Services.

Depending on the Services and version you use, these may include:

Amazon Web Services (AWS)

AWS provides infrastructure and hosting services, including databases, application APIs, storage, security infrastructure, and related services. EveCare production infrastructure is primarily hosted in the United States.

Google and Firebase Services

EveCare may use:

• Firebase Analytics
• Firebase Crashlytics
• Firebase Remote Config
• Firebase Firestore
• Google Sign-In
• Related Google services

Firebase Analytics may receive technical and usage information such as application events, screen information, device/application information, and certain error information.

Crashlytics may process crash reports, stack traces, device information, operating-system information, breadcrumbs, and technical identifiers.

EveCare does not intentionally send individual health values to these analytics or crash-reporting services.

Apple

Where Apple Sign-In is used, Apple may process authentication information according to Apple's applicable terms and privacy practices.

Firebase Cloud Messaging (FCM)

EveCare uses FCM for push notifications. FCM may process:

• Push tokens
• Player identifiers
• Device information
• EveCare account identifiers or tags
• IP address or technical information
• Notification content necessary to deliver notifications

Push notifications may contain health-related topics, such as period reminders or breast self-examination reminders.

Because notification content may appear on your device's lock screen or notification area, other persons who can access your device may potentially see it.

Brevo

EveCare uses Brevo for transactional and, where applicable, marketing email communications.

Amazon SES

Sends our email. Sees name and email address.

Razorpay

EveCare uses Razorpay for applicable payments. EveCare may provide Razorpay with information necessary to process a transaction, such as:

• Order ID
• Transaction amount
• Currency
• Email address
• Phone number
• Payment status
• Applicable provider transaction identifiers

EveCare does not store your complete payment-card or bank-account credentials.

RevenueCat

Handles app-store subscriptions. Sees an account identifier and subscription status. No health data.

Bunny.net

Delivers the yoga videos (content delivery network, global edge). Sees video requests; no account data.

GeoJS

EveCare may use GeoJS or similar IP-location functionality to estimate general geographic location when device-based location is unavailable.

8.1 Service Provider Restrictions

EveCare selects service providers based on the services they provide and contractual, technical, or operational safeguards applicable to the relationship.

EveCare does not authorize its service providers to use consumer health information for their own targeted or behavioral advertising on EveCare's behalf.

Some providers may independently process information under their own privacy terms when they act as separate controllers or service providers. You should review the applicable third-party privacy notices where appropriate.

9. Push Notifications and Communications

EveCare may send push notifications, emails, or other communications relating to:

• Account activity
• Security
• Reminders
• Health tracking
• Assessments
• Educational content
• Service updates
• Other Services you use

Some notifications may relate to sensitive health topics.

You can manage push notifications through your device settings and certain communication preferences through the Services.

Disabling notifications may prevent certain reminders from being delivered but will not necessarily stop essential account or security communications.

10. Employer, Corporate and Sponsored Programs

EveCare may offer employer-sponsored, corporate, insurer, broker, institutional, or other sponsored programs.

Where you participate in such a program, the sponsoring organization may receive limited administrative information necessary to administer the program, such as:

• Name
• Email or work email
• Program participation
• Seat or enrollment status
• Aggregated or de-identified program information where applicable

Unless otherwise expressly explained to you and permitted by applicable law, EveCare does not provide your individual health information to an employer for employment decisions.

Participation in an employer-sponsored program does not by itself authorize the employer to access your individual health information.

Where reporting is provided to a sponsor, EveCare may use aggregation, de-identification, minimum group-size thresholds, or similar safeguards designed to reduce the risk that an individual user can be identified from program reporting.

11. When We May Share Information

EveCare may disclose personal information when reasonably necessary and permitted by applicable law.

Service Providers

We may disclose information to vendors and service providers that help us:

• Host and operate the Services
• Provide infrastructure
• Process payments
• Send communications
• Deliver notifications
• Provide analytics and diagnostics
• Provide customer support
• Maintain security
• Perform other services on our behalf

Professional Advisers

We may disclose information to lawyers, accountants, auditors, consultants, insurers, and other professional advisers where reasonably necessary.

Legal Requirements

We may disclose information where required or permitted by law, regulation, court order, subpoena, governmental request, or other lawful process.

Security and Protection

We may disclose information where reasonably necessary to investigate or prevent fraud, security incidents, abuse, unlawful activity, or threats to users or others.

Corporate Transactions

If EveCare is involved in a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar corporate transaction, personal information may be transferred as part of that transaction, subject to applicable legal requirements and appropriate safeguards.

At Your Direction

We may disclose information when you specifically direct or authorize us to do so.

Aggregated or De-identified Information

We may use or disclose information that has been aggregated or de-identified so that it is not reasonably capable of being associated with an identifiable individual, subject to applicable law.

12. International Data Transfers

EveCare operates internationally and may process information in countries other than the country where you live.

Our primary production infrastructure is located in the United States.

Depending on the Service, information may also be processed in other jurisdictions, including India and other locations where our service providers operate.

When required by applicable law, EveCare will use appropriate mechanisms and safeguards for international transfers.

13. How Long We Keep Information

EveCare retains personal information for as long as reasonably necessary to provide and secure the Services, fulfill the purposes described in this Policy, comply with applicable legal and regulatory obligations, resolve disputes, enforce agreements, prevent fraud and abuse, and protect our legal rights.

EveCare does not automatically delete an account solely because the account has been inactive for a particular period of time. An account may remain available while inactive unless you request deletion, EveCare is required to delete the information by applicable law, or another lawful basis for deletion applies.

Retention periods may therefore differ depending on the type of information, the purpose for which it was collected, applicable legal requirements, and whether you continue to maintain an account.

Certain information may be retained for longer periods where necessary or permitted by law, including for:

• Legal and regulatory compliance
• Accounting, tax, payment, or transaction requirements
• Fraud prevention and security
• Dispute resolution
• Establishment, exercise, or defense of legal claims
• Enforcement of agreements
• Maintaining limited security or suppression records necessary to prevent fraud, abuse, or unauthorized re-enrollment
• Other purposes permitted by applicable law

When you request deletion of your account, EveCare will process the request in accordance with the account-deletion process described in Section 14, subject to applicable legal exceptions and required retention.

After the applicable retention period, EveCare will delete, de-identify, anonymize, or otherwise dispose of information in accordance with applicable law and our data-retention and deletion procedures.

Certain information held by third-party providers, such as payment processors, email providers, analytics or crash-reporting services, or other infrastructure providers, may be retained according to their own applicable retention policies and legal obligations.

Encrypted backups may also continue to contain information for a limited period after deletion from active production systems until those backups expire or are overwritten in accordance with the applicable backup lifecycle.

14. Deleting Your Account and Information

You may request deletion of your EveCare account through the available account-deletion functionality or by contacting us at support@evecarehealth.com.

Where account deletion is initiated, EveCare's applicable deletion workflow may include a 30-day grace period before permanent deletion.

After the applicable grace period, EveCare's deletion process is designed to erase the account and associated user information from production systems, including applicable:

• Profile information
• Health information
• Period and cycle information
• Weight
• Blood pressure
• Glucose
• Temperature
• Breast self-examination information
• Care-related records
• Journals
• Symptoms
• Medical history
• Assessments
• Screenings
• Device information
• Subscriptions
• Orders
• Corporate program information
• Yoga or education progress
• Community information, where applicable
• Uploaded files and associated storage objects
• Other information associated with the account, subject to applicable legal exceptions

EveCare may retain a limited tombstone or suppression record, such as a cryptographic hash or equivalent identifier derived from certain account information, where reasonably necessary to prevent unauthorized re-enrollment, fraud, abuse, or other security problems.

EveCare may also retain limited aggregated information that cannot reasonably identify you.

Deletion of your EveCare account does not necessarily cause third-party providers to immediately erase information they are independently required or permitted to retain under their own policies or applicable law. For example:

• Payment providers may retain transaction records
• Email/support systems may retain communications
• Analytics or crash-reporting providers may retain technical records according to their policies
• Backup systems may retain encrypted copies for a limited period before those copies are overwritten or otherwise disposed of in accordance with the applicable backup lifecycle

Where applicable law requires a particular retention period, EveCare may retain information for that period.

15. Security

EveCare uses administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

Depending on the system and information involved, safeguards may include:

• Field-level encryption of health data
• TLS-protected communications
• Access controls
• Role-based access controls
• Authentication mechanisms
• Credential and secrets management
• Security monitoring
• Rate limiting
• Backup controls
• Restricted administrative access
• AWS security services and controls
• Database encryption
• Storage encryption
• Incident-response procedures

EveCare's production systems use AWS infrastructure, including Amazon RDS, Amazon S3, AWS Lambda, API Gateway, DynamoDB, CloudFront, Secrets Manager, Parameter Store, KMS, and related services as applicable.

No security system is completely secure, and EveCare cannot guarantee that information will never be accessed, disclosed, altered, or destroyed through an unauthorized event.

If EveCare determines that a security incident requires notification under applicable law, we will provide notice as required by that law.

16. Health Information and HIPAA

EveCare handles health-related information with heightened care.

However, HIPAA does not automatically apply to every health application or every organization that processes health information.

HIPAA generally applies to covered entities and their business associates as defined by federal law. Whether EveCare is subject to HIPAA for a particular Service depends on the nature of the Service and EveCare's relationship with the relevant covered entity or business associate.

Where EveCare acts in a capacity subject to HIPAA, EveCare will comply with applicable HIPAA requirements and applicable contractual obligations, including business associate obligations where applicable.

Where HIPAA does not apply, other privacy and consumer-protection laws may still apply.

EveCare does not represent that the entire EveCare platform is universally subject to HIPAA merely because it processes health information.

Where applicable, EveCare may also be subject to federal, state, or other consumer-health privacy and breach-notification requirements, including the FTC Health Breach Notification Rule. The FTC has specifically clarified the Rule's applicability to certain health apps and similar technologies outside HIPAA.

17. Children

EveCare uses age-related controls and parental-consent mechanisms where required.

Where EveCare is required to obtain verifiable parental or guardian consent before collecting or processing information from a child, EveCare will implement the applicable consent process before processing information requiring such consent.

We may collect information necessary to determine age eligibility and administer applicable parental or guardian controls.

The age up to which a parent or guardian must approve an account depends on the country whose rules apply to you: under 18 in India and in the Gulf states (Saudi Arabia, the United Arab Emirates, Qatar, Bahrain, Kuwait and Oman), under 16 in the European Union and European Economic Area, and under 13 elsewhere. To decide which country applies, we use your app store country, the country of your network (IP address) and your phone's region setting. If they point to different countries, we apply the strictest of those rules. If we cannot tell, we apply the under-18 rule.

Where applicable, parents or guardians may contact EveCare regarding:

• Information collected from a child
• Consent
• Withdrawal of consent
• Access
• Deletion

Requests may be sent to support@evecarehealth.com.

EveCare does not knowingly use children's information for targeted behavioral advertising.

Where applicable law imposes additional requirements for children or minors, EveCare will apply those requirements.

18. Your Privacy Rights

Depending on your location and applicable law, you may have rights concerning your personal information.

These may include the right to:

• Know or access personal information
• Obtain a copy of personal information
• Correct inaccurate information
• Request deletion
• Withdraw consent where processing is based on consent
• Object to or restrict certain processing
• Limit certain uses of sensitive personal information
• Opt out of sale or sharing where applicable
• Opt out of targeted or cross-context behavioral advertising where applicable
• Appeal certain privacy decisions
• Lodge a complaint with a relevant privacy or data-protection authority
• Exercise additional rights provided under applicable law

To submit a request, contact support@evecarehealth.com.

We may need to verify your identity before completing certain requests. Verification information will be used for the purpose of processing and securing your request.

EveCare will not discriminate against you for exercising privacy rights where prohibited by applicable law.

19. Additional Regional Privacy Information

19.1 California Residents

California law may provide additional rights concerning personal information.

Under the California Consumer Privacy Act, as amended, certain information processed by EveCare may constitute sensitive personal information, including health information and precise geolocation.

Depending on applicability and statutory exceptions, California residents may have rights to:

• Know/access personal information
• Correct inaccurate personal information
• Delete personal information
• Opt out of sale or sharing
• Limit certain uses and disclosures of sensitive personal information
• Exercise other rights provided under California law

EveCare does not sell consumer health information and does not use consumer health information for targeted behavioral advertising.

EveCare does not knowingly sell or share consumer health information for cross-context behavioral advertising.

California residents may submit requests through support@evecarehealth.com.

Where required by California law, EveCare will honor applicable opt-out preference signals and provide required methods for exercising applicable rights.

EveCare may deny or limit a request where permitted by law, including where an applicable legal exception applies.

California's privacy laws and regulations may change over time. EveCare will update its practices and disclosures as required.

19.2 India

For users in India, EveCare may process personal data in accordance with applicable Indian data-protection and privacy requirements, including the Digital Personal Data Protection Act, 2023 and applicable rules and provisions when they become applicable to the relevant processing.

The Digital Personal Data Protection Rules, 2025 were notified on November 13, 2025 and contain a staggered commencement framework.

Depending on the applicable legal framework and EveCare's role, users may have rights concerning access, correction, erasure, consent withdrawal, grievance redressal, and other applicable data-principal rights.

Where applicable law provides this right, you may nominate another person to exercise your rights on your behalf if you die or become unable to act.

Requests and grievances may be submitted to privacy@evecarehealth.com.

Grievance Officer: Anjum Shaikh

EveCare will maintain additional India-specific notices or procedures where required by applicable law.

19.3 Other Jurisdictions

Privacy rights vary by jurisdiction.

If you are located outside the United States or India, you may have additional rights under local privacy or data-protection law.

You may contact EveCare at support@evecarehealth.com and we will assess your request under the law applicable to you.

20. Changes to This Policy

EveCare may update this Privacy Policy from time to time to reflect:

• Changes to the Services
• Changes in technology
• Changes in our privacy practices
• Legal or regulatory developments
• Other operational requirements

When we make material changes, we may provide notice through the Services, email, or other appropriate means where required.

The updated Policy will include a revised effective date.

Where we make a material change affecting processing that relies on your consent, we will ask for your consent again within the Services before relying on the updated Policy for that processing.

Otherwise, your continued use of the Services after the effective date of an updated Policy constitutes acknowledgement of the updated Policy to the extent permitted by applicable law.